# A Deep Learning Framework for Enhanced Detection of Polymorphic Ransomware
## Appendix A Case Studies  
This appendix is an extension of Section 2.1, Ransomware Attacks and Trends. The purpose is to summarize and characterize the seminal ransomware incidents that have had devastating consequences in terms of critical infrastructure, resources, operations, and impact. High-Impact Ransomware Attacks on Critical Infrastructure  
The May 2021 ransomware attack on JBS S.A., the world's largest meat processing company, exemplifies the severe disruption such attacks can inflict on critical industries. Attributed to the REvil ransomware group, the attack forced the temporary closure of JBS facilities in the United States, Australia, and Canada, threatening global meat supply chains and raising concerns about price increases. JBS paid a USD 11 million ransom in Bitcoin to restore operations. This incident highlighted the vulnerability of highly consolidated food industries and underscored the growing threat of ransomware to essential sectors. Also in May 2021, the Colonial Pipeline ransomware attack demonstrated the devastating impact on energy infrastructure. Carried out by the DarkSide group, the attack compelled the shutdown of the pipeline, which supplies nearly half of the East Coast's fuel. This resulted in fuel shortages, panic buying, and price surges, causing significant disruption to transportation and the economy. Colonial Pipeline paid a USD 4.4 million ransom (partially recovered by the FBI). The attack triggered a federal response, emphasizing the critical vulnerability of energy pipelines and the potential for widespread economic damage from cyberattacks. While REvil and DarkSide executed the JBS and Colonial Pipeline attacks, the Ryuk ransomware group's activities provide crucial context for understanding the broader threat landscape. [PERSON], associated with the Wizard Spider/Grim Spider group, specializes in targeted attacks against high-value organizations, often using TrickBot for initial network access. Its tactics, including lateral movement and sophisticated encryption, are common among ransomware groups, highlighting the shared vulnerabilities within critical infrastructure. Therefore, studying [PERSON]'s methods is essential for developing effective defenses against similar high-impact attacks, even those carried out by other threat actors. The Ryuk group is also important to note when discussing attacks on large organizations, such as the attack on Change Healthcare. Change Healthcare occupied a significant position within the U.S. healthcare sector, particularly in healthcare technology and business solutions. Operating at the critical intersection of healthcare providers, payers, and patients, it provided a wide array of services, including revenue cycle management, payment processing, and data analytics. This placed the company as a vital intermediary in the flow of healthcare information and financial transactions. Its systems handled massive volumes of sensitive patient data and financial transactions, making it a crucial component of U.S. healthcare infrastructure, with its services being used by a large number of hospitals, clinics, and insurance companies. It is important to note that Change Healthcare is now part of Optum, which is part of UnitedHealth Group, a move that has further solidified its position within the healthcare technology landscape. The recent cyberattacks on Change Healthcare have demonstrated just how vital a part of the healthcare infrastructure it was. Therefore, Change Healthcare's sector position can be characterized as a critical infrastructure provider within the U.S. healthcare system, a dominant player in healthcare technology, particularly in revenuecycle management and data exchange, and a central hub for healthcare transactions and data, connecting various stakeholders. In essence, it was a linchpin in the operational and financial workings of the U.S. healthcare industry. In summary, this section illustrates the escalating threat of ransomware attacks on critical infrastructure through several high-profile case studies.