Internal Security

Sub-topics in Cyber Threat Landscape

Internal Security·Revision Notes

Ransomware and Malware — Revision Notes

Updated 6 Mar 2026

⚡ 30-Second Revision

  • Ransomware: Malware encrypting data, demanding crypto ransom.
  • Malware: Broad term for malicious software (viruses, worms, Trojans).
  • Double Extortion: Encrypt + Exfiltrate data, threaten publication.
  • RaaS: Ransomware-as-a-Service, professionalized cybercrime model.
  • Key Vectors: Phishing, RDP, unpatched vulnerabilities, supply chain.
  • Major Attacks: WannaCry, NotPetya (wiper), Colonial Pipeline, AIIMS.
  • IT Act 2000: Sections 43 (damage), 66 (offences), 70B (CERT-In).
  • CERT-In: National nodal agency for cyber incident response.
  • NCIIPC: Protects Critical Information Infrastructure (CII).
  • Prevention: Backups (offline/immutable), MFA, patching, segmentation, awareness.
  • Emerging Trends: AI-powered malware, Living-off-the-Land, crypto laundering.
  • UPSC Angle: Internal Security, Economic Impact, Legal Framework, International Cooperation.

2-Minute Revision

    1
  1. Ransomware vs. Malware: — Malware is a broad category of malicious software. Ransomware is a specific type of malware that encrypts data and demands payment for decryption, directly monetizing attacks. This distinction is crucial for targeted defense strategies.
    2. 2
  2. Evolution & RaaS: — Ransomware evolved from simple viruses to sophisticated, targeted attacks. Ransomware-as-a-Service (RaaS) professionalized the threat, allowing less skilled criminals to launch attacks by leasing tools and infrastructure, significantly expanding the threat landscape.
    3. 3
  3. Attack Vectors: — Common entry points include phishing emails, exploiting unpatched software vulnerabilities, brute-forcing Remote Desktop Protocol (RDP) credentials, and compromising supply chain partners. Understanding these vectors is key to prevention.
    4. 4
  4. Impact on Critical Infrastructure: — Ransomware poses a severe threat to sectors like healthcare (AIIMS), energy (Colonial Pipeline), and finance, leading to operational disruption, economic losses, and national security risks. The cascading effects can be catastrophic.
    5. 5
  5. India's Response: — India's legal framework, primarily the IT Act 2000 (Sections 43, 66, 70B), and institutions like CERT-In and NCIIPC, form the backbone of its defense. However, challenges in attribution and cross-border enforcement persist.
    6. 6
  6. Prevention & Emerging Trends: — Effective prevention involves robust backups, MFA, patching, network segmentation, and user awareness. Emerging threats include AI-powered malware, living-off-the-land techniques, and sophisticated cryptocurrency laundering, demanding continuous adaptation.

5-Minute Revision

Ransomware and malware are central to the contemporary cyber threat landscape, demanding a comprehensive understanding for UPSC. Malware is the overarching term for any malicious software, designed for disruption, data theft, or unauthorized access.

Ransomware is a specialized form of malware characterized by its direct financial extortion model: it encrypts a victim's data or locks their system, demanding a cryptocurrency payment for restoration.

The evolution of ransomware has seen it move from simple 'locker' variants to 'crypto-ransomware' and, more recently, 'double-extortion' models where data is also exfiltrated and threatened to be published.

This professionalization is epitomized by 'Ransomware-as-a-Service (RaaS),' which lowers the barrier to entry for cybercriminals, fueling a lucrative 'ransomware economy.

Attack vectors are diverse, with phishing emails, exploitation of unpatched software vulnerabilities (including zero-days), brute-forcing Remote Desktop Protocol (RDP) credentials, and supply chain compromises being the most prevalent.

Notable global incidents like WannaCry and NotPetya (a destructive wiper disguised as ransomware) demonstrated the potential for widespread disruption, while the Colonial Pipeline attack highlighted critical infrastructure vulnerabilities.

In India, the AIIMS Delhi ransomware attack underscored the severe impact on essential services and sensitive data.

The economic impact extends beyond ransom payments to significant downtime, recovery costs, and reputational damage. This directly impacts national security by threatening critical information infrastructure (CII) across sectors like healthcare, energy, and finance, potentially causing cascading failures and economic destabilization.

India's response is multi-layered. The Information Technology Act, 2000, particularly Sections 43 (damage), 66 (computer-related offenses), and 70B (establishing CERT-In), provides the legal framework.

Institutions like CERT-In (national incident response), NCIIPC (CII protection), and Cyber Swachhta Kendra (malware removal) form the operational backbone. However, challenges persist in attribution, cross-border jurisdiction, and keeping pace with rapidly evolving threats.

International cooperation, through mechanisms like the Budapest Convention and bilateral agreements, is crucial for a borderless threat.

Prevention strategies are paramount: regular, offline, and immutable backups; multi-factor authentication (MFA); robust patch management; network segmentation; endpoint detection and response (EDR) solutions; and continuous security awareness training.

Incident response plans must be developed and regularly tested. Emerging trends include the use of Artificial Intelligence (AI) by both attackers and defenders, 'living-off-the-land' techniques, and increasingly sophisticated cryptocurrency laundering methods.

For UPSC, this topic requires an analytical understanding of the technical, economic, legal, and geopolitical dimensions, with a focus on India's preparedness and policy responses to safeguard its digital future.

Prelims Revision Notes

    1
  1. Definitions: — Malware (broad malicious software), Ransomware (malware encrypting data for ransom). RaaS (Ransomware-as-a-Service: developers lease tools to affiliates). Double Extortion (encrypt + exfiltrate data). Locker vs. Crypto-ransomware.
    2. 2
  2. IT Act 2000: — Sec 43 (civil penalty for damage), Sec 66 (computer-related offenses, criminal), Sec 66B/C/D (stolen resource, identity theft, cheating), Sec 70 (Protected System), Sec 70B (CERT-In establishment).
    3. 3
  3. Key Institutions: — CERT-In (Indian Computer Emergency Response Team - national nodal agency for incident response, advisories). NCIIPC (National Critical Information Infrastructure Protection Centre - protects CII). Cyber Swachhta Kendra (Botnet Cleaning and Malware Analysis Centre - free tools).
    4. 4
  4. Attack Vectors: — Phishing/Spear-phishing (emails), RDP (Remote Desktop Protocol) compromise, Exploit Kits (software vulnerabilities), Supply Chain Attacks (third-party compromise), Misconfiguration.
    5. 5
  5. Notable Strains: — WannaCry (EternalBlue exploit, global, NHS impact), NotPetya (wiper, disguised as ransomware, Ukraine focus), CryptoLocker, Locky, Colonial Pipeline (critical infra), AIIMS (India, healthcare).
    6. 6
  6. Prevention: — Multi-Factor Authentication (MFA), Regular Backups (offline, immutable), Patch Management, Network Segmentation, Endpoint Detection & Response (EDR), Security Awareness Training, Incident Response Plans.
    7. 7
  7. Emerging Trends: — AI-powered malware, Living-off-the-Land (LotL) techniques, Cryptocurrency laundering, Professionalization of RaaS.
    8. 8
  8. International: — Budapest Convention (key treaty, India not signatory but engages), MLATs (Mutual Legal Assistance Treaties).
    9. 9
  9. UPSC Focus: — Factual recall of definitions, legal provisions, institutional roles, major incidents, and prevention methods.

Mains Revision Notes

    1
  1. Conceptual Framework: — Define Ransomware and Malware, highlighting their distinct objectives and the evolution from simple viruses to sophisticated RaaS models and double extortion. Emphasize the 'ransomware economy' aspect.
    2. 2
  2. Impact Analysis: — Analyze the multi-dimensional impact:

* Economic: Direct ransom, downtime costs, recovery, reputational damage, insurance, cryptocurrency role. * National Security: Threat to Critical Information Infrastructure (CII) (healthcare, energy, finance), cascading effects, potential for state-sponsored disruption (e.g., NotPetya as wiper). * Societal: Disruption of public services, erosion of trust, data privacy concerns.

    1
  1. India's Preparedness (Legal & Institutional):

* Legal: IT Act 2000 (Sections 43, 66, 70B) as foundational. Discuss its strengths and limitations (attribution, jurisdiction, technical expertise, evolving threats). Mention proposed reforms (Digital India Act, DPDP Bill). * Institutional: Roles of CERT-In, NCIIPC, Cyber Swachhta Kendra, I4C. Evaluate their effectiveness and coordination.

    1
  1. Mitigation Strategies (Comprehensive):

* Technical: Patching, EDR, network segmentation, robust offline/immutable backups, MFA, threat intelligence. * Organizational: Incident Response Plans (IRPs), tabletop exercises, security awareness training, 'zero-trust' architecture.

* Policy/Governance: National Cyber Security Strategy implementation, public-private partnerships, capacity building for law enforcement. * International: Bilateral/multilateral cooperation, MLATs, information sharing, advocating for global norms.

    1
  1. Emerging Challenges: — Discuss AI-powered malware, Living-off-the-Land techniques, supply chain attacks, and cryptocurrency regulation challenges.
    2. 2
  2. UPSC Focus: — Analytical depth, critical evaluation, policy recommendations, current affairs integration (AIIMS, Colonial Pipeline), and inter-topic connections (CII protection, data privacy, international relations). Structure answers with clear arguments and a forward-looking conclusion.

Vyyuha Quick Recall

Letters

Letter

R

Visual Aid

A digital lock with a Bitcoin symbol.

Explanation

Ransom: Demands payment, typically crypto, for decryption.

Letter

A

Visual Aid

A fishing hook catching an email icon.

Explanation

Attacks: Phishing, RDP, vulnerabilities, supply chain are key vectors.

Letter

N

Visual Aid

A national flag with a broken power grid behind it.

Explanation

National Security: Threatens Critical Infrastructure (CII) and economy.

Letter

S

Visual Aid

A legal scroll with 'IT Act 2000' written on it.

Explanation

Sections: IT Act 2000, especially 43, 66, 70B, are legal basis.

Letter

O

Visual Aid

A shadowy figure in a suit, holding a laptop.

Explanation

Organized Crime: RaaS model professionalizes cyber extortion.

Letter

M

Visual Aid

A generic 'bug' icon with a lock on its back.

Explanation

Malware: Ransomware is a specific type of malicious software.

Letter

W

Visual Aid

A world map with red dots spreading rapidly.

Explanation

WannaCry: Global 2017 attack, exploited EternalBlue, hit NHS.

Letter

A

Visual Aid

A hospital building with a 'system down' alert.

Explanation

AIIMS: Major Indian case study, healthcare infrastructure hit.

Letter

R

Visual Aid

A shield with a 'tick' mark, representing defense.

Explanation

Response: CERT-In, NCIIPC, backups, MFA, patching are crucial.

Letter

E

Visual Aid

A robot head with glowing red eyes, symbolizing AI threats.

Explanation

Emerging: AI-powered malware, double extortion, LotL techniques.

Mnemonic

RANSOM-WARE

Related Topics