The global rise of ransomware

Episode Summary

Executive Summary: The episode examines ransomware as a rapidly growing, highly organized criminal industry that targets businesses, hospitals, and infrastructure worldwide. BBC reporter Joe Tidy explains how gangs like Revil and DarkSide operate, why they are difficult to catch, the debate over paying ransoms, and how law enforcement is increasingly responding with arrests, takedowns, and recovery of stolen cryptocurrency.

Main Topics: Ransomware as a major cyber threat (Priority: 5/5): The program explains ransomware as malware that encrypts files and demands payment, highlighting its impact on healthcare, industry, and critical infrastructure. Real-world attacks and business impact (Priority: 5/5): Examples include WannaCry disrupting the NHS, Revil attacking Central Wire, and broader attacks on food suppliers and pipelines, showing that any organization can be hit. Why ransomware gangs are hard to catch (Priority: 5/5): The discussion covers Tor, cryptocurrency, limited digital footprints, Russian-speaking forums, and the challenge of proving responsibility across borders. The organizational structure of ransomware gangs (Priority: 4/5): Guests describe these groups as professional, businesslike operations with specialization, negotiators, and customer-service-like systems. Safe havens and state tolerance (Priority: 4/5): Cybersecurity expert Jen Ellis outlines how some countries cannot or will not prosecute attackers, and suggests political tolerance may exist in some cases. Whether victims should pay the ransom (Priority: 5/5): There is a split between practical arguments for paying to keep a business alive and principled arguments that paying funds crime and expands the ransomware economy. Law enforcement countermeasures (Priority: 4/5): Authorities are increasingly using international arrests, sanctions, takedowns, and cryptocurrency recovery operations to disrupt ransomware groups.

Key Arguments: Ransomware has become a national-security issue because it threatens hospitals, schools, pipelines, and other critical services, not just private company finances. The gangs operate like professional businesses, with division of labor, negotiators, and structured online infrastructure. They are difficult to catch because they use Tor, encrypted channels, cryptocurrency, and often operate from jurisdictions that are unwilling or unable to act. Evidence pointing to Russian-based groups includes Russian-language forums, malware that avoids Russian systems, and reduced activity during Russian public holidays. Paying the ransom may be the cheapest way to restore operations for some victims, but it also funds and legitimizes criminal enterprises. Law enforcement is becoming more aggressive, using coordinated arrests and hacking back to seize or recover criminal funds. Small businesses and hospitals face especially hard choices because downtime can threaten jobs or patient care, making ransom decisions ethically complex.

Data Points: WannaCry year: 2017 - Ransomware attack that hit the UK National Health Service and closed hospitals Central Wire ransom demand: 1.7 million US dollars - Ransom note left after the company was encrypted by Revil Revil earlier earnings claim: 100 million dollars - Joe Tidy says the gang previously claimed this amount on its dark website before rebranding from Gant Crab Years active: about 4 or 5 years - Estimate of how long Revil has been operating Number of gangs: probably about a dozen - Tidy’s estimate of major ransomware organizations currently active Health-related attack share: one in five attacks - UK NCSC says this proportion now affects health-related businesses or organizations NCSC comparison: more attacks in first four months of 2021 than the whole of 2020 - UK NCSC annual-report related claim about scale of escalation Countries affected by Evil Corp attacks: 40 different countries - Reported scale of extortion or theft attributed to the group Amount extorted or stolen: over 100 million dollars - US/UK allegations against Evil Corp Dallas sheriff’s office example ransom: 4,000 dollars - Tom Pace cited this case as an example of why some victims pay Small business payment example: 50,000 dollars - Tom Pace described this as potentially easier than losing a company Wedding cost estimate: 250,000 to 600,000 dollars - Estimate for Maxim Jakubets’ luxury wedding based on online video and venue research Distance of Yoshkar-Ola from Moscow: 700 kilometres east - Joe Tidy’s trip to the hometown of an alleged Evil Corp associate

Pivotal Quotes: "Generally speaking, my advice is to pay the ransom." — Tom Pace: The former ransomware negotiator argues that for many businesses, paying can be the fastest and cheapest route to recovery "They turn up for work, they're in huge offices, they take it very seriously, they put in their hours." — Jen Ellis: Describing ransomware gangs as sophisticated, businesslike organizations "These people are running a business." — Tom Pace: Tom Pace explains why he believes paying often gets victims the encryption keys back

Implications: Ransomware is now a systemic risk to business continuity and public safety. Organizations need stronger backups, patching, authentication, and incident planning, while governments must intensify cross-border enforcement and disrupt the criminal economy.