Why Ransomware Needs A Human Touch

Ransomware is currently one of the biggest threats in malware attacks. Although the first known attack occurred in 1989, only in the last 6 years has this threat greatly increased and become more sophisticated. The lack of adequate security measures and awareness propelled the rapid spread and increased severity of ransomware variants (e.g., WannaCry ransomware in 2017). Further, there is little research work on this matter, only traditional protections are available and even state-of-the-art mobile malware detection approaches are still ineffective. This greatly increases the attack surface on the mobile domain. To better understand the research work performed on this subject, this paper presents a detailed review of the literature on ransomware, existing mainly since 2015. Results show that most work focus on the analysis of ransomware structures and development/testing of detection solutions. Very few studies focus on human related solutions or ransomware prevention. This paper also presents an analysis of a sample of ransomware email subject lines regarding the integration of persuasion content and targeted/personal aspects, so to identify and understand more human aspects of the attack. In order to avoid mistakes similar to other social engineering malware research approaches (e.g., email phishing and scams), which have been more comprehensively studied, ransomware research direction must be completely reversed. It must focus mainly on prevention and backup/restoring procedures, which are related to sociotechnical solutions that can manage and understand users' awareness, workflow, behaviours and needs.