The Archiveus trojan, the first ransomware to use RSA, encrypted all files in the “My Documents” folder. GPcode attacked Windows operating systems, first using symmetric encryption and later, in 2010, using the more secure RSA-1024 to encrypt documents with specific file extensions. The “Archiveus” trojan and “GPcode” were the most notable of these early ransomwares. The early years (2005–2009)Īfter this first event, no notable developments in the field of ransomware took place until 2005, when ransomware reemerged-this time using secure asymmetric encryption.

The ransomware was relatively easy to remove using online decryptor tools. After a user had booted up ninety times, the names of the user’s files would be encrypted and the below message would appear, asking victims to send US$189 to a PO box in Panama. The first ransomware attack is generally regarded as the “AIDS trojan.” It is named for the 1989 World Health Organization (WHO) AIDS conference, at which biologist Joseph Popp handed out 20,000 infected floppy discs to event participants. But in order to understand how to prepare today, it’s also necessary to understand how ransomware has evolved to reach its current state.

It’s imperative for all organizations to have a plan for how to prevent and respond to ransomware attacks. Where there’s data, there’s an opening for threat actors to hold this sensitive information ransom and demand payment for its release. Ransomware has grown to become a potential threat for all organizations, sparing no industry or size bracket in its goal to capture files and other company assets.

Users compromised by crypto locker