Dissecting a Ransomware Operation: From Propagation to extortion

Ransomware evolution

A Rootcon speaker traces ransomware from Joseph Popp's 1989 AIDS Trojan floppy targeting WHO attendees—symmetric encryption and Panama bank payments easily reversed—to today's epidemic fueled by cryptocurrency, global connectivity, and strong public-key cryptography.

Ransomware-as-a-Service

Modern operators sell builders and affiliate programs with monthly subscriptions near forty dollars or eighty-twenty profit splits, providing encryptors, decryptors, negotiation infrastructure, and customizable payloads while affiliates conduct attacks.

Attack chain

Affiliates still rely heavily on phishing, including HR-themed resume attachments with nested archives, exploiting non-technical departments. A Vietnam livestreamer case shows attackers impersonating Black Myth: Wukong developers to deliver malware during a broadcast. The talk covers affiliate onboarding, builder customization, and common initial access vectors preceding encryption.