A brief history of ransomware: What it teaches us about the business of cybercrime (and how to disrupt it)

Ransomware didn’t become a billion-dollar industry overnight. The ‘success’ of ransomware as a cybercrime model was years in the making and one of the best examples of innovation in the adversary ecosystem to date. Ransomware was an inflection point—it turned hobbyist hacking into big business. In doing so, it laid the foundation for a global criminal ecosystem that now mirrors many of the structures, strategies, and scaling tactics seen in the business world.

This session tells the story of ransomware—from humble beginnings to today’s professionalised extortion operations-at-scale. This story shows the remarkable ability of adversaries to innovate and continually evolve their operations in order to keep the business of cybercrime alive – and eventually to thrive. The ransomware approach didn’t just disrupt the business of cybercrime—it demonstrated the enormous commercial potential of it, setting the pattern for arguably the greatest current cyber threat.

This session will outline some of the ways governments are attempting to disrupt ransomware – working with industry on technical fixes and disrupting the business model of ransomware itself. The session will also offer clear, tactical guidance for security professionals, helping them to look beyond the malware itself to the techniques and strategies adversaries are currently using to target victims.

This talk will leave attendees with a fresh perspective: ransomware isn’t just a threat—it is a business model. And by studying how the business model of ransomware works, we can better understand how to disrupt it—both in the policy arena and on the digital frontlines.