## 2 Literature Review and Investigation of the Trends of Ransomware Threats  
### Brief Overview of Ransomware Attacks of the Last Six Months from the Worldwide News  
Data assets and their associated software environments are currently the greatest technological assets. The developers of extortion viruses are taking advantage of this to try to attack almost any organization for which the above two are essential for their operation. Today, as a result of our growing IT vulnerability and profitability, this form of attack is responsible for nearly a third of security incidents. The continued rise of cryptocurrencies and the steep increase in their exchange rate makes their inclusion (as ransom) very attractive to cyber criminals, and it does not help that many prominent players in the tech industry are also accepting them as a form of payment, legitimizing it. These tendencies can be seen in Figures 1 and 2 [1]. For the period under review, an increase in the number of ransomware-type attacks was observed, as well as a significant increase in the exchange rate of Bitcoin, the most commonly used cryptocurrency by attackers. On the one hand, the change in the exchange  
Figure 1: One-year Bitcoin rates in USD. Figure 2: One-year Bitcoin rates in USD. rate with the appreciation of Bitcoin has unfortunately intensified ransomware-type attacks, while at the same time, the consideration for the ransom demanded by the attackers in Bitcoin has multiplied. In the spring of 2020, BTC 1 was convertible at USD 7185, whilst the same in April 2021 represented USD 62,926. At the same time, this also means that although the amount set in Bitcoin during the extortion virus attacks did not change, companies and institutions still paid out orders of magnitude more to the extortionists to recover the data and prevent data leakage. There clearly seems to be a trend, but currently there are simply not enough data to prove this correlation. In 2019, EUR 10.1 billion in ransoms were paid by victims within the EU, which is EUR 3.3 billion more than in 2018. The attacks detected showed an increase of 365% during the first 6 months of 2018 and 2019, while on average, victims paid ransoms in 45% of cases, while nearly half of them lost their data [2]. In 2018, the attackers still mainly targeted multinational companies, however, since 2019, the public sector and its cloud services which provide and manage education and healthcare have also gradually become targets. It is also a matter of concern that, according to 2019 reports, 66% of healthcare institutions in the EU have experienced such an attack [3]. The year 2020 estimates that extortion viruses caused a total of EUR 400 billion in damage within the EU. According to U.S. statistics, we see that in 2020, nearly 184 million attacks were detected [4]. Meanwhile, by 2020, attacks have become increasingly sophisticated. The length of the algorithms and keys used for encryption also make decryption difficult. The ransom is already often claimed in Bitcoin and the amount claimed also increases over time. Attackers often put under pressure by not only taking data hostage, but also by threatening to publish or sell it. In addition, the situation caused by the COVID-19 pandemic has led to a particular focus on healthcare institutions. The first registered death caused by an extortion virus occurred at a clinic in Dusseldorf on the 10 September 2020, while a widespread wave of attacks has swept across German healthcare facilities [5]. From an economic point of view, one of the most serious incidents in 2020 was the DoppelPaymer extortion virus attack on Foxconn, in which nearly 1200 servers were encrypted, 100 GB of data were stolen and 30 TB of backups were erased, while attackers demanded USD 34.7 million in Bitcoin [6]. To date, a REvil ransomware attack was the most critical in economic terms, targeting Acer in March 2021, where the actors were demanding the largest known ransom to date--USD 50,000,000 [7].