## 2 Literature Review and Investigation of the Trends of Ransomware Threats
### State-of-the-Art Research in Ransomware-Type Cyberthreats  
There are several points of interest related to cybersecurity questions [8]. On the one hand, the detection of malicious servers is an important task, and on the other hand, the early detection of ransomware-type vulnerabilities is a key factor in the prevention of data loss. In the international literature and news, as already mentioned in the introduction, we read more and more often about ransomware-type cyberattacks. The range of targets is widening, and there are almost no areas in the economic and administrative sphere where there would be no affected victims of such an attack. Unfortunately, the attacks show several trends that encourage IT security professionals to make a serious effort. One of these is that their attacks are becoming more sophisticated, with more and more organizations perceived behind them. Another issue is the elaborated preparation regarding the economic potential for exploitation of the victims attacked: this is indicated by the determination of the value of the ransom, which is far from random. The third and most problematic dimension of the attacks is the change in the nature of the targets. Unfortunately, there has been a proliferation of attacks on public institutions, schools and educational institutions, but the most severe have been on hospitals that save lives and provide healthcare. Attacks on hospitals are already subject to a completely different assessment, a much more serious act than previous attacks, and their reward is a threat to mass human life. The efforts of colleagues in the field of information security have been strongly motivated by this factor, and various technological developments, innovations, new methods for the development and improvement of intrusion detection and prevention systems are appearing almost continuously. [PERSON] et al. [9] investigated the possibility of preventing client-side attacks. It was found that the increase in the number of client-side attacks can be attributed, on the one hand, to the fact that server protection systems are much more advanced, and better and centrally monitored. Using as few resources as possible and in the shortest amount of time that attackers want to achieve their goal, this is obvious. The combined result of these two factors is that they want to enter the network environment by attacking the clients and then continue their activities there. The variety of client-side attacks also makes this path easier for attackers to navigate. As the authors noted in the article, in many cases, currently available systems focus on identifying malicious servers, and isolating clients from these servers is only a secondary consideration. Their proposed solution for detecting and preventing malicious servers is already blocking the malicious link at the gateway. Cyberattacks, particularly ransom-oriented attacks, most often target Windows clients and servers. Ransomware itself is a member of the malware family, a malware that has caused significant damage to users and server owners over the last 4 years. Ransomware is designed to block access to data on victims' computers in some cases, but as a general mechanism of operation, for most of them, it encrypts data, documents, backups and databases. Unfortunately, decrypting and decoding the data is almost the same if it is not done by a professional, but even then, there is no chance that the data can be recovered 100%. The perpetrators of the attacks offer a decryption key for a ransom, as well as a decoder application that can be used to decrypt the files. On the behavioral mechanisms of different types of ransomware, [PERSON] et al. [10] have reviewed three years of experience with 20 ransomware families based on more than 200 different ransomware samples. In recent years, the COVID-19 pandemic period which started in 2019 and continues to this day has brought new impetus to this branch of cybercrime, with the rise of work from home and distance learning.