A CyberTalk roundup walks through the ransomware crews that have done the most damage over the last decade, and the patterns are depressingly familiar. WannaCry, Ryuk, DoppelPaymer and LockBit each arrived with their own twist, but the underlying lessons line up. Here is the short version, plus what an IT or security team should actually do with it.
The short version
- The piece cites ransomware as a top concern for organisations of every size.
- The average ransom demand is reported to exceed $2.2 million.
- About 1 million ransomware attacks were estimated worldwide in the first half of 2022.
- 97 per cent of attacks last year aimed to infect backup databases.
- 80 per cent of organisations were affected by ransomware in 2021.
- WannaCry hit more than 300,000 computers in over 150 countries in May 2017.
- Ryuk was first detected in August 2018 and has hit hospitals, governments and large corporations.
- LockBit is described as among the most active ransomware groups, tied to a large share of infections worldwide.
WannaCry and the patching lesson
WannaCry is still the cleanest teaching example in the stack. It used a Windows SMB vulnerability that Microsoft had already patched months earlier. According to CyberTalk, the worm spread across more than 300,000 machines in over 150 countries and caused up to $4 billion in damages. Most of those victims were running outdated Windows, including Windows XP, which Microsoft no longer supported.
The takeaway is not new, but it is still ignored: unpatched internet-facing systems are the single biggest ransomware accelerant. Patching a known flaw would have stopped almost every WannaCry infection cold. The CyberTalk framing is blunt and correct: the attack was avoidable.
Ryuk, DoppelPaymer and the operator playbook
Ryuk showed up in August 2018 and quickly became a staple of big-game hunting. Hospitals, local governments and large corporations were typical targets. The entry vector was almost always phishing, which is why the CyberTalk advice centres on anti-phishing controls and user education. Backups also matter; the 3-2-1 rule keeps showing up because it keeps working.
DoppelPaymer appeared in mid-2019 and went after large organisations, including a German car supplier and the city of Torrance in the United States. It used sophisticated encryption and could evade many antivirus engines. The CyberTalk advice is the usual hardening list: monitor ingress and egress, alert on data extraction, enforce multi-factor authentication and apply least-privilege permissions on file shares.
None of this is exotic. The reason it keeps appearing in ransomware retrospectives is that operators keep exploiting the same gaps.
LockBit and the ransomware-as-service era
LockBit arrived in 2021 with a tools-as-a-service model and a double-extortion routine: encrypt the data, then threaten to leak it. According to the CyberTalk roundup, LockBit is now one of the most active ransomware groups, tied to a large share of infections worldwide. The double-extortion twist changed the maths for victims, because even clean backups no longer save you from a public leak.
LockBit is also a useful case study in what ransomware-as-service does to the market. Lower-skill affiliates can rent a polished toolkit, and the core developers keep iterating on the encryptor. That is why antivirus vendors keep playing catch-up: the binaries change, but the tradecraft is stable.
Our analysis
The interesting bit is not any single family. It is the convergence. Modern crews all do some flavour of double or triple extortion, all target backups early, and all abuse legitimate tooling once they are inside. The defensive playbook has converged too: patch internet-facing systems, segment backups from production, enforce MFA, monitor for data staging and practise the restore.
The trade-off is cost. Doing all of that properly is a multi-year programme, not a quarterly project. Smaller teams will not get to the same maturity as a Fortune 500 security org, and that is exactly who LockBit affiliates hunt.
A worked example
Say you run security for a regional hospital. Your EHR is fully patched, but the file share that doctors use to drop imaging exports is on a legacy Windows Server with no MFA. A Ryuk-style affiliate phishes a clinician, lands on that file share, and finds a folder with read-write access for "everyone". Within an hour the share is encrypted and the attackers are asking for an eight-figure sum.
The fix is not a bigger antivirus budget. It is removing "everyone" from the share, putting MFA in front of it, isolating that host from the rest of the network, and making sure the backup copy is on a system the clinician cannot reach from their normal account. None of that requires a new product. It requires someone owning the file share.
What to watch next
Watch the affiliates, not the brands. LockBit, BlackCat and Cl0p all lose infrastructure, then reappear under a new name within months. Track the tradecraft, not the press release.
Key takeaways
- Patching known flaws still beats any ransomware tool on the market.
- Backups must be isolated and tested, not just configured.
- Double-extortion changes the maths: clean backups do not stop a leak.
- Identity hygiene, MFA and least privilege block the most common paths in.
Frequently asked questions
What was WannaCry and why does it still matter?
WannaCry was a 2017 ransomware worm that hit more than 300,000 computers across 150 countries. It still matters because it exploited a vulnerability that had already been patched, which makes it a permanent case study in patch discipline.
How does ransomware-as-service work?
Core developers build the encryptor, leak site and negotiation portal, then rent access to affiliates who run the intrusion. That model has powered LockBit and many of the current top crews.
Are backups enough to defeat ransomware?
Backups defeat encryption, but not data theft. With double extortion, attackers also threaten to leak data, so identity controls and least privilege still matter.
Which ransomware family is the biggest threat right now?
LockBit is named in the CyberTalk piece as one of the most active groups worldwide, tied to a large share of infections, though affiliate rebrands make precise tracking hard.
Source: cybertalk.org