Tuesday, June 16, 2026

Tracing the malware path

What began as a revenge action by Harvard educated evolutionary biologist Joseph Popp - who was not considered for a permanent position at the World Health Organization - turned out to be the malicious step towards institutionalizing the dark economy of hacking. With computer connectivity and data sharing gaining new interest during late 1980s, Popp conveniently used the computer software for promoting AIDS education in 1989. It was so designed that the malware shocked the user but without any data being lost. The victim’s computer hard drive was restored after the originator was paid to unlock it. Popp used a payment mechanism system that was easily accessible to the victim but not the police.

Anja Shortland, a professor at the King’s College, traces the malware path that was paved in 1989, and which has now fully grown into a ransom industry worth $1 billion each year. The cost to global business in 2025 has been a whopping $74 billion. “It is like trashing a car to steal a pair of sunglasses,” quips Shortland. But Popp had to prove his worth to two adversaries: the organization that didn’t acknowledge his credentials for a permanent position, and the arrogant ‘masters of the universe’ of the business world. Popp’s plot to extract payment for data hostage didn’t last long but before falling into obscurity he could bequeath a blueprint for ransomware for later generation of hackers.

Since its first appearance in the late 80s, ransomware has gone through many astonishing changes. No sooner the criminals’ payments problem was resolved, ransomware quickly advanced from a low-level nuisance to a problem touching all facets of society. A ransomware attack is a cybercrime in which hackers use malware to encrypt data and charge a fee to receive a decryption key. In financial terms it might seem an inefficient form of crime, but is still growing all across in the internet connected world because it’s much cheaper to cough up incentive then minimize its devastating disruptions.

Shortland, a leading expert in cybercrime peels many layers of digital underworld that is reshaping our online existence in her latest book We Know You Can Pay a Million, which seeks to explore the large corporate set-ups that have grown up around the ransomware industry. The most amazing aspect of this industry is that the havoc wreaked by ransomware is many times over the amount collected by cybergangs. Such has been the psychological cost of the recent attack that the production of the Jaguar Land Rover has been set back by weeks. The British Library has yet to fully recover from the hacking it suffered in 2023.

The astonishing aspect of ransomware attacks is that every attack inspires further attacks. Despite the effort and creativity that goes into taking every attack down, the threat of ransomware to companies and individuals gets greater than ever. The number of arrests and takedowns lead to proliferation and splintering of ransomware brands. For instance, security experts could spot as many as seventy-five ransomware strains, with an average of forty-five groups active each month in the recent past. Leading group LockBitSupp asserts: “This business works…and will always work…takedown isn’t an indication of a systematic problem with ransomware.” 

Shortland says that ransomware became a real problem from 2013 onwards when internet became widespread. The challenge is transboundary and indeed global. Between 2021 and 2024, the US alone counted some 4,900 attacks leading to at least US$ 3.1 billion in ransomware payments. For anyone tracking the daily stream of global ransomware attacks, the extreme vulnerability of global and local supply chains, public services, transport and critical infrastructure is abundantly clear. With ports, trains and airports been subject to temporary shutdowns, the vulnerability of cyber connected infrastructure is glaring.

Need it be said that artificial intelligence will ease ransomware gangs to target a country. It will have serious repercussions to national security and peoples’ lives. Costa Rica was attacked in 2022 and has valid reasons for promotion of higher standards of cyber-hygiene. Shortland has proposed the counter-ransomware dashboard with four interconnected features including penalties and resilience. She further suggests that the ransomware be brought into the sphere of broad political debate. Politicians must be pressed to formulate clear cybersecurity strategies. This book may not be interest to the average reader but must get the attention of the right people to avoid unimaginable catastrophe.

We Know You Can Pay a Million
by Anja Shortland
Hachette, New Delhi
Extent: 293, Price: Rs, 699.

First published in Hindu BusinessLine on June 15, 2026.

No comments:

Post a Comment