Decoding Ransomware: A Thematic Analysis of Trends and Countermeasures

Abstract: This study investigates the evolving landscape of ransomware attacks and critically evaluates the effectiveness of current countermeasures. Drawing on a thematic analysis of secondary data from global case studies, cybersecurity reports, and academic literature, the research highlights the commodification of ransomware through Ransomware-as-a-Service (RaaS). It identifies key attack vectors, including phishing, Remote Desktop Protocol (RDP) exploitation, and unpatched vulnerabilities, while examining the increasing sophistication of extortion tactics such as double and triple extortion. Organisational responses are assessed, distinguishing proactive defenders with layered security infrastructures from reactive institutions hampered by limited preparedness, particularly in under-resourced regions. Findings indicate that resilience depends on comprehensive strategies that integrate technological safeguards, user education, and policy-level interventions. This study concludes that ransomware is no longer merely a technical threat but a systemic challenge requiring coordinated action across sectors and jurisdictions. Practical recommendations are offered to support scalable, context-aware defences and foster cybersecurity maturity.

Ransomware, Thematic Analysis, Cybersecurity, Countermeasures, Digital Resilience

1. Cloudflare. (2025). WannaCry ransomware: What it was and how it spread. Cloudflare. https://www.cloudflare.com [Google Scholar] [Crossref]

2. Cloudwards. (2025). The latest ransomware statistics & trends. Cloudwards. https://www.cloudwards.net/ransomware-statistics/ [Google Scholar] [Crossref]

3. Colonial Pipeline ransomware attack. (2023). In Wikipedia. [Google Scholar] [Crossref]

4. https://en.wikipedia.org/wiki/Colonial_Pipeline_ransomware_attack [Google Scholar] [Crossref]

5. Creswell, J. W. (2014). Research design: Qualitative, quantitative, and mixed methods approaches (4th ed.). SAGE Publications. [Google Scholar] [Crossref]

6. CryptoLocker. (2023). In Wikipedia. https://en.wikipedia.org/wiki/CryptoLocker [Google Scholar] [Crossref]

7. Cybersecurity Ventures. (2025). Ransomware damage is expected to cost the world $57B in 2025. https://cybersecurityventures.com [Google Scholar] [Crossref]

8. Fortinet. (2025). Ransomware statistics 2025: Latest trends & must-know insights. Fortinet. https://www.fortinet.com [Google Scholar] [Crossref]

9. Kaspersky. (2025). WannaCry ransomware: All you need to know. Kaspersky. https://www.kaspersky.com [Google Scholar] [Crossref]

10. KnowBe4. (2021). AIDS Trojan ransomware. https://www.knowbe4.com/ransomware-knowledgebase/aids-trojan [Google Scholar] [Crossref]

11. MITRE ATT&CK. (2024). REvil ransomware. https://attack.mitre.org/software/S0496/ [Google Scholar] [Crossref]

12. SentinelOne. (2024). REvil ransomware: Analysis, detection, and mitigation. SentinelOne. https://www.sentinelone.com/anthology/revil/ [Google Scholar] [Crossref]

13. Sophos. (2024). The state of ransomware 2024. Sophos. https://www.sophos.com/en-us/content/state-of-ransomware [Google Scholar] [Crossref]

14. Trend Micro. (2023). Ransomware spotlight report: Conti and LockBit. Trend Micro. https://www.trendmicro.com [Google Scholar] [Crossref]

15. WannaCry ransomware attack. (2023). In Wikipedia. https://en.wikipedia.org/wiki/WannaCry_ransomware_attack [Google Scholar] [Crossref]

• Advanced Techniques for Fake News Detection on Twitter Using NLP and AI: A Comprehensive Review
• Review of Self Compacting Geopolymer Concrete Using Slag Sand as Fine Aggregate
• Performance of Local Construction Contractors – Case Study of Registered Contractors in Monrovia, Liberia
• Cross-Cultural Perspectives on Innovation Management in Multinational Organizations
• Modeling of Reaction Between Dissolved Oxygen (DO) And Biological Oxygen Demand (BOD) in Degradation River