Keywords

1 Introduction

The Internet is currently the fastest-growing infrastructure, and modern technologies are transforming human activities. However, the widespread use of technology has resulted in increased cybercrime and the vulnerability of personal information [1]. The term “ransomware” originated from the word “ransom” and “malware,” and it has become a significant contributor to the surge in cyberattacks as it can generate profits for attackers. In the past, hackers had difficulties profiting from their attacks, but this is no longer the case. Cybercriminals are increasingly using ransomware attacks where they gain access to a victim's data, encrypt it, and demand payment [2].

Ransomware is a type of virus that can prevent users from accessing their computer system. It frequently spreads through malicious websites that take advantage of flaws in hardware and software. Some of the most common ransomware viruses include CryptoLocker, Petya, Bad Rabbit, Ryuk and Maze [3]. These viruses primarily target document storage files, such as MS office, PDF, and CSV files, and use strong encryption to make them virtually inaccessible without a specific decryption key. Once infected, the attacker demands payment from the victim and provides instructions on how to retrieve the encrypted files. If the ransom is paid, the attacker will post a message on the computer screen with information on how to retrieve the files, thus ending the attack. This technique is known as cryptovirology [4].

Ransomware, which can appear as Crypto or Locker variations, is a highly hazardous and complex form of malware. Targeting and seizing control of crucial infrastructure and computer systems is its main goal. These assaults are generally carried out for financial gain, either directly by requesting ransom payments in exchange for decryption keys or indirectly. Researchers have thoroughly examined scholarly literature on the inner workings of ransomware, including its particular assault patterns and tactics, in the hunt for viable solutions [5, 6]. These effects can include data loss as a consequence of file encryption, significant costs for incident response and other security-related issues, and, in the worst cases, even fatalities as a result of unanticipated failures of vital medical equipment [7, 8].

Prior systematic reviews in academic literature have mostly focused on the effects of ransomware within specialized industries, such as healthcare, while ignoring the larger fact that ransomware assaults are prevalent across multiple areas. This study aims to fill this specific vacuum by providing a thorough analysis of the complete ransomware attack lifecycle and an understanding of its unique characteristics. This thorough study is meant to act as a basis for future research projects in this area. The report also explores current approaches for the detection and prevention of ransomware, offering a comprehensive evaluation of their relative benefits and drawbacks. Additionally, the article provides details on a variety of preventive techniques that may be used to reduce the risk associated with malicious activities.

1.1 Prior Research

Computer networks may be vulnerable to attacks that compromise the system or its users by taking advantage of connection or network flaws. These assaults may be roughly divided into two categories: active and passive, with each using a variety of strategies and ways to illegally obtain data, identities, or financial assets. While passive attacks only observe or eavesdrop on network activity without doing any harm, active attacks are intentional attempts to manipulate or harm the network [9].

Joseph L. Popp is known as the “father of ransomware” for creating the first ransomware virus in 1989. This set the stage for modern ransomware threats, which can be spread through infected USB drives or phishing emails containing malicious attachments or links. Ransomware has become a serious threat, often encrypting user data and demanding payment through difficult-to-trace bitcoin. Figure 1 provides a visual representation of ransomware.

Fig. 1.
figure 1

List of Ransomware Attack [9]

Full size image

1.2 Types of Ransomware Attacks

  1. 1)

    Crypto-Ransomware- Encrypts files on the victim's computer and demands a ransom for decryption. WannaCry, WannaCry, Petya, CryptoLocker [10].

  2. 2)

    Locker-Ransomware Locks the victim out of their system entirely, preventing access to any files or applications. Win locker, Police Trojan, FBI Virus [11].

  3. 3)

    Scareware Ransomware- Displays false warning messages to trick the victim into paying the ransom. Fake antiviruses, Tech support frauds.

  4. 4)

    RaaS (Ransomware-as-a-Service)- A business model where cybercriminals sell ransomware to other attackers for a share of the profits. Satan, Shark, Philadelphia.

  5. 5)

    Mobile Ransomware- target mobile devices, locking the user out or encrypting data on the device. Simplocker Android/Filecoder.C.

Fig. 2.
figure 2

Operating system effected by ransomware.

Full size image

However, the role of operating systems in ransomware attacks cannot be overlooked. Observations have shown that devices utilizing the Windows operating system tend to be more susceptible to these attacks and are frequently singled out as targets [12]. Nevertheless, it’s essential to recognize that other operating systems, such as iOS and MacOS, are not exempt from vulnerability. This underscores the fact that the threat of ransomware is pervasive and no operating system is impervious to it [13]. Figure 2 demonstrated in various instances.

Ransomware is a form of cyber-attack that involves the use of encryption to block access to a victim's data, and a demand for payment in exchange for the decryption key [14]. According to research conducted in the field, ransomware can be traced back to the early 1990s, when cryptography was first used for exploitation purposes. However, at that time, it was not possible to demand money from victims because it was easy to trace the recipient. It was only with the introduction of cryptocurrency that the idea of using ransomware as a means of making money became viable. Therefore, the emergence of cryptocurrency can be linked to the rise of ransomware attacks.

Furthermore, a critical analysis of the impact of ransomware attacks on organizations in different countries was conducted. The analysis revealed that in 2021, approximately 50% of organizations in several countries were affected by ransomware attacks. The figure below depicts the countries where the highest number of organizations were negatively impacted by ransomware attacks (Fig. 3).

Fig. 3.
figure 3

Ransomware attack success rates in the past 12 months vary by country.

Full size image

1.3 Major Problem

Previous systematic reviews of ransomware have mainly focused on its impact in specialized industries such as healthcare, and government organizations neglecting the fact that ransomware is not limited to specific domains. To address this limitation, this paper proposes a comprehensive evaluation of the detecting and mitigating of ransomware, serving as a starting point for further research. Furthermore, the paper discusses existing methods for detecting ransomware, analyzing their pros and cons. Lastly, prevention tools for ransomware attacks are discussed, providing valuable insights for organizations looking to enhance their security measures against ransomware threats.

1.4 Study Objectives

The aim of this study is to examine prior research, consolidate its findings, and concentrate on analyzing ransomware attacks, risks, mitigation, and prevention methods to control ransomware attacks. The study also aims to provide recommendations for the use of these techniques and tools, as well as identify areas for future research in this field. Ultimately, the objective would be to contribute to the development of more effective strategies for mitigating the impact of ransomware attacks. To achieve this goal, three research questions have been formulated, as shown in Table 1.

Table 1. Formulated Questions and discussion
Full size table

1.5 Contribution and Structure

This systematic literature review provides a valuable resource for individuals seeking to advance their knowledge in ransomware attacks and cyber security. By synthesizing previous research, it builds upon existing knowledge and makes new research, as discussed in Table 1.

  • Our review identified 31 papers that are relevant to the topics of cyber security and ransomware threats and detection. This set of studies can serve as a resource for other researchers who seek to further investigate these areas.

  • Organize and classify different methods of ransomware attacks into a specific taxonomy.

  • We investigated the conditions utilized for evaluating defense, detection, mitigation, and prevention techniques against ransomware attacks.

  • We identified available research data for a future analysis of ransomware and provided guidelines to assist in further research in this field.

The structure of this paper unfolds as follows: Sect. 2 explains the methodology employed to systematically select primary studies for our comprehensive analysis. In Sect. 3, we present the outcomes derived from our scrutiny of the selected primary research studies. Finally, Sect. 4 serves as the result of our research efforts, offering conclusions drawn from our findings and suggesting recommendations for future investigations.

2 Methodology

The research methodology section of this paper describes the systematic approach taken to look at previous studies about prospective ransomware attacks and their corresponding detection systems. Article offer details on the inclusion and exclusion criteria used to choose relevant research, also describe how we locate articles, papers, books, and journals about ransomware attacks.

2.1 Source Material

The study utilized a specific search engine and focused on entering relevant keywords to ensure the retrieval of primary research that would address the research questions. The selected keywords were carefully chosen to optimize the development of relevant findings. Boolean operators were limited to AND and OR. The search terms used were: (insert the specific keywords used).

(“ransom” OR “ransom-ware” OR “ransomware” OR “Mal-ware” OR “Malware” OR “ransomware attacks”) AND “information security” (“ransomware” OR “ransom” OR “Malware AND (“security” OR “cybersecurity” OR “cyber-security”).

In the first phase, the task to be performed for the quality of research is to undertake an exhaustive literature search. Therefore, a search was conducted using six different electronic libraries namely IEEE Xplore, Science Direct, ACM, Springer, Web of Science, and Google Scholar to search for the relevant materials.

The search process for relevant studies involved using titles, keywords, and abstract depending on the platform used. All studies published up to a certain point were included and filtered based on the selection/eligibility criteria provided in Sect. 2.2. The search process was conducted iteratively, both forward and backward, until no further publications that met the selection criteria could be found.

According to [3, 17], ransomware refers to a type of malicious software that encrypts data and demands payment in exchange for its release. This literature review includes both published and ongoing research studies related to ransomware attacks. The review methodology involves a four-step process, which is illustrated in Fig. 4. The process includes library searches and various steps to identify and select relevant articles for analysis.

Fig. 4.
figure 4

Scoping Literature review process

Full size image

To conduct the literature search, various search options were used in different databases. In IEEE, the search option “anywhere” was selected, while in Google Scholar, the “anywhere in the article” option was used. For Web of Science, the search was limited to the “subject” parameter. The search included a variety of publication types, such as journal articles, book sections, working papers, conference papers, dissertations, and reports.

Advanced search filters were used to refine search results, including past 13 years, document types, and English language. New keywords like “cyber risk” and “challenges and analysis” were added. A slimming approach was used to analyze articles, removing duplicates, and considering only English-language textual sources. 30 journal articles were selected for the literature study, as shown in Fig. 4.

2.2 Inclusion and Exclusion Criteria

A systematic literature review requires empirical evidence from case studies, new ransomware attacks, and advancements in ransomware mitigation technologies. English-written, peer-reviewed studies must meet standards, and only updated ones within recent years are considered. Google Scholar results may not meet standards, so all results are evaluated for compliance (Table 2).

Table 2. Inclusion and exclusion criteria for primary studies
Full size table

2.3 Selection Results

A total of 648 studies were searched, but duplicates were removed, leading to 474. After evaluating, 38 publications were identified. The criteria were applied again, reducing the number to 30 papers.

2.4 Quality Assessment

The primary studies were assessed for quality in accordance with the guidelines. The evaluation aimed to determine the relevance of the papers to the research questions while considering any possible research bias and the reliability of the experimental findings. The evaluation process was modeled after similar literature reviews. To evaluate the effectiveness of randomly selected papers, a specific quality assessment procedure was implemented.

  • Step 1: Ransomware: The article should discuss multiple forms of ransomware attacks or security breaches and offer insightful commentary on a specific issue.

  • Step 2: Perspective: The research's objectives and conclusions should be properly contextualized to ensure a comprehensive understanding of the study.

  • Step 3: Ransomware detection Strategy: Study must provide enough information to show how technology is used to detect attacks and answer research questions, including specific tools and techniques used for detection and mitigation.

  • Step 4: Defense context: The document should explain the security issue to help answer research questions, including its nature, potential consequences, and challenges in addressing it.

  • Step 5: Security measures: The application of diverse security measures to alleviate several types of ransomware attacks.

  • Step 6: Data Recovery: Specifics on data collection, measurement, and reporting must be provided to assess accuracy.

2.5 Data Extraction

The data completeness and accuracy of articles were assessed by extracting data from quality-approved papers. The technique was tested on a preliminary investigation before being applied to the full set of research. Data was categorized and entered into a spreadsheet using the following categories.

Context Data:

Information involving the study’s performed objectives.

Qualitative Data:

The author’s findings and opinions.

Quantitative Data:

Information collected through tests and research has been used in the study.

2.6 Meaningful Keywords Count

A keyword analysis was conducted on all 38 studies to identify the common themes among the selected primary research. The frequency of various words used across all studies was compiled and presented in Table 3. As observed in the table, “Machine Learning” is the third most frequent term in the dataset, following “ransomware” and “Trojan,” and preceded only by the author's chosen keywords “ransomware” and “security”.

Table 3. Keywords count from primary studies.
Full size table

3 Findings

Table 4 summarizes relevant qualitative and quantitative data extracted from the main research papers. Each primary study had a specific objective or theme related to previous research on ransomware attacks, which is also indicated in the table.

Table 4. Finding of the primary studies
Full size table

3.1 RQ1: What Are the Current State-of-the-Art Techniques and Tools Used for Detecting Ransomware?

Ransomware detection techniques include behavioral analysis, signature-based detection, and machine learning. Popular tools include antivirus software, specialized ransomware detection tools, and managed detection and response services [32]. A combination of these techniques and tools can help detect and protect systems from ransomware attacks.

  • Signature-based detection: Signature-based detection compares known malware signatures to identify malware (Malwarebytes)

  • Heuristic-based detection: Heuristic-based detection analyzes the behavior of files or processes to detect malware. This can be more effect in detecting new or unknown ransomware

  • Machine learning-based detection: Machine learning-based detection uses machine learning models to identify ransomware based on its behavior or characteristics, it may not be able to detect very new ransomware (Crowed strike falcon)

  • Behavioral analysis: Behavioral analysis monitors process behavior to identify suspicious activity that may indicate the presence of ransomware, may generate false positive (McAfee)

  • Network traffic analysis: Network traffic analysis examines network traffic to identify suspicious activity that may indicate the presence of ransomware

  • Sandboxing: Sandboxing runs files or processes in a controlled environment to observe their behavior and identify ransomware

3.2 RQ2: How Effective Are Existing Mitigation Strategies in Preventing Ransomware Attacks and Their Associated Damages?

Mitigation strategies such as regular data backups, patch management, user education, and antivirus software can be effective in preventing ransomware attacks and their damages. However, their effectiveness depends on proper implementation and maintenance [33]. Organizations and individuals should prioritize these strategies to minimize the risk of ransomware attacks illustrated in Tables 5 and 6.

Table 5. Mitigation Strategy
Full size table
Table 6. Ransomware Tactic techniques
Full size table

3.3 What Are the Most Common Tactics and Techniques Used by Ransomware Attackers and How Can These Be Thwarted?

Ransomware attackers commonly use social engineering, phishing, and software vulnerabilities to gain access to systems and demand payment [30]. To thwart these attacks, user education, software patching, data backups, network segmentation, and access controls can help prevent these attacks and limit their impact.

4 Mitigation and Prevention Techniques of Ransomware

Preventing ransomware is crucial to protect against its damaging effects on individuals and corporations. In case of infection, data recovery can be challenging and may require the help of a trusted specialist. Pre-encryption mitigation refers to the security measures taken before the encryption process to minimize the risk of security breaches.

  • Implementing strict access policies, network segmentation, regular software, and hardware updates, password management and employee training and awareness

  • Quarantine suspicious emails, inspect attachments in malware sandbox

  • To identify unknown ransomware at pre-encryption stage

  • During detection of ransomware, false positives, and false negatives high

  • To prevent execution of exploits in a user’s system

  • Hibernate system to interrupt encryption and recover file encryption key

  • To block ransomware when ransomware starts encryption, it is recommended

Fig. 5.
figure 5

Ransomware attack life cycle [32]

Full size image

5 Recommendations

Ransomware is a major cybersecurity threat, with limitations in current prevention and detection methods. Improved prediction techniques are necessary to identify future attacks, along with cyber profiling and transaction tracing to track ransom payments and attackers. Despite significant research efforts, finding a long-term solution to pre-encryption of ransomware remains a critical challenge due to its dynamic nature. Organizations can minimize the risk of security breaches and protect sensitive information from unauthorized access, which can help them avoid costly security incidents and reputational damage (Fig. 5 and 6).

Fig. 6.
figure 6

Ransomware pre-encryption attack mitigation model

Full size image

The ransomware mitigation paradigm focuses on defining parameters for the pre-encryption phase of the lifecycle, allowing the model to respond before sabotage occurs. This allocation prevents premature cutoff issues and allows for sufficient data collection. A temporally correlated pre-encryption description technique, based on the IRP-API, links resources to cryptography-related APIs. This API separates the pre-encryption phase and encryption phase for user-related files. Machine learning algorithms are applied to forecast ransomware or benign attacks, using pre-encryption border entries to identify ransomware instances [38].

6 Conclusion

This paper discusses the emerging cyber-threat of ransomware and its monetary impact on organizations. It analyzes various security measures and proposes a model for preventive measures to avoid pre-encryption attacks. Tools like endpoint protection solutions, intrusion detection systems, and advanced threat detection technologies can help organizations detect and prevent ransomware attacks. Utilizing these tools enhances defense strategy effectiveness. In the future ransomware can be detected at early stage and also pre-encryption can be implemented with machine learning algorithm to reduce false positive and false negative rates, also can be improved using heuristic based to detect new and unknown ransomware.