Cutting the Gordian Knot: A Look Under the Hood of Ransomware Attacks

By Amin Kharraz, William K. Robertson, Davide Balzarotti, Leyla Bilge, Engin Kirda. International Conference on Detection of intrusions and malware, and vulnerability assessment, 2015

446 citations recorded by the source corpus.

How researchers see this paper

The researchers whose trusted networks rank it highest, strongest advocate first. Every researcher gets a different order.

UNVEIL: A large-scale, automated approach to detecting ransomware (keynote) (2016, background): “[21] analyzed 15 ransomware families and provided an evolution-based study of ransomware at tacks.”
Social Engineering Attacks: A Survey (2019, background): “Getting back the files after the victim’s payment is not guaranteed [30,31].”
ShieldFS: a self-healing, ransomware-aware filesystem (2016, background): “Kharraz et al. [7] studied the behavior of scareware and ransomware, observing its evolution during the last years, in terms of encryption mechanisms, ﬁlesystem interactions, and ﬁnancial incentives.”
CryptoLock (and Drop It): Stopping Ransomware Attacks on User Data (2016, background): “Because our study covered nearly four times the number of families of the previous study [25] and there was little diversity within families, there was little need to collect additional samples.”
Automated Dynamic Analysis of Ransomware: Benefits, Limitations and use for Detection (2016, background): “In [17] the authors analyse 15 different ransomware families, by showing that the large majority of samples implement locking or encrypting techniques through näıve techniques.”