Exploring the ransomware ecosystem and the active defense concept: Review of attacks and defense

Abstract

Ransomware has become one of the most notorious types of malware, increasingly targeting end-users, governments, and businesses. Its growing sophistication poses a significant cybersecurity threat. Researchers have proposed numerous defense solutions to mitigate the ransomware threat. They have also conducted over 10 review studies to cover certain aspects of ransomware in the past ten years. However, none of them detail the attack mechanisms or explore possible mitigation strategies. To this end, we present a comprehensive review of ransomware and its defenses. We detail the attack mechanisms and vulnerabilities exploited by ransomware, and assess both commercial and academic defense solutions. Additionally, we explore active defense concepts that help mitigate ransomware threats and provide strategic guidance for future ransomware defense efforts. Our survey serves as an entry point into the study of ransomware and its defense, offering potential insights for enhancing existing solutions and minimizing the impact of ransomware attacks.