5 reasons why ransomware can’t be stopped easily

There are more ransomware attacks than ever, and public institutions and private companies alike know that becoming the next target is no longer a question of “if”, but “when”.

How did we get here? For twenty years, companies have bought antivirus protection and still lost the game. We wrote this article in September 2021, in the middle of a wave of attacks, and the five reasons below explain why ransomware still hasn’t gone away in 2026. The examples are from 2020–2021; at the end you’ll find the latest figures and the measures that matter now.

1. Broken “Windows” can’t be fixed

Microsoft Windows and its associated software are full of vulnerabilities. In just the three months before this article was published, in the summer of 2021, Microsoft fixed more than 200 bugs, 27 of them critical and most of the rest rated important. At least six of them had been actively attacked before a patch came out.

In March 2021, four “zero-day” vulnerabilities in Microsoft Exchange led to breaches in thousands of organizations. One of these bugs had been in Exchange since 2013, and the others dated from 2016 and 2019. At the time, we explained what to do if your Exchange server has been compromised.

The PrintNightmare vulnerability, discovered in the summer of 2021 in the Windows Print Spooler service, allowed remote code execution and was quickly added to popular hacking tools such as Mimikatz and Metasploit. Even after the first fix, researchers quickly found a way to bypass it completely. Similar vulnerabilities, such as FaxHell, Print Demon and Evil Printer, had been discovered in 2020, and attackers kept looking for systems exposed to flaws like these.

Some bugs stay hidden for years, even decades. CVE-2021-24092 is a privilege escalation vulnerability in Windows Defender, the Microsoft security software that is supposed to keep attackers out. The bug remained exploitable for 12 years.

IT services for companies: tell me more →

It’s tempting to think it’s only a matter of time until all these bugs are found and fixed, but unfortunately that’s not how it works. New bugs arrive with new code, and Microsoft, like any other vendor, has to build new features – and write new code – to stay attractive to businesses. The local privilege escalation vulnerability HiveNightmare (or SeriousSAM), discovered in July 2021, had been introduced into Windows 10 with version 1809. It allowed any standard user to gain full SYSTEM privileges, with all the consequences that implies for security teams.

Although HiveNightmare requires the attacker to already have a foothold in the system, combining it with other flaws, such as PrintNightmare, can give them both access and full permissions.

Nothing has changed in 2026: every month, Microsoft fixes dozens of vulnerabilities, and some are exploited before the fix comes out. Windows 10 computers, which stopped receiving free updates on October 14, 2025, remain exposed to every bug discovered since then (see the problem with end-of-life technologies).

2. Sophisticated attacks beat basic security, every time

Bugs aside, the basic protection built into Windows isn’t enough on its own to stop sophisticated attacks. According to NETRESEC, the Sunburst/SolarWinds attack, discovered in December 2020, was not stopped by Windows Defender, and the malware also got past other vendors’ security products, which didn’t provide the visibility needed to detect the attack.

Of course, sophisticated attacks are designed precisely to defeat simple security controls, and the days when any protection at all was enough for a company are long gone.

Today’s online financial crime runs on leverage. Attackers want your data – to sell it, to hold it for ransom, or both – and they have the means to buy, develop and steal the tools they need. Ever since the Shadow Brokers group leaked the NSA’s hacking tools in 2017 – including EternalBlue, used in the WannaCry and NotPetya attacks – criminal gangs have had access not only to those tools, but also to the know-how needed to build tools like them.

What’s more, there’s an entire ecosystem on the Dark Web that gives even less skilled attackers access to powerful tools developed by others. The Ransomware as a Service model means that developers of sophisticated malware can sell it to a large number of customers, each paying a relatively low price. It’s a simple business model, and attackers have understood it and exploited it to the full.

Ransomware as a service (RaaS) – what it is and how it works

With ransomware affiliates lining up to break into companies, and powerful tools that defeat simple controls, security can no longer rely on people alone to do the heavy lifting. Sophisticated attacks call for sophisticated tools that can respond on their own, at machine speed. As long as many organizations haven’t learned this lesson, we’ll keep seeing large-scale ransomware attacks on public institutions and private companies alike.

3. The rewards outweigh the risks

Buggy software and weak security controls, combined with low risks and high returns, make ransomware an attractive business for criminals. In the early days, cybercriminals didn’t realize how much money was waiting for them if they attacked companies and institutions, so they focused on individuals, automatically demanding $300 from each one. In 2010, one cybersecurity commentator observed that “Internet ransom may not bring in much money per incident, but patient extortionists can cast a wide net and haul in many innocent victims who have no recourse but to pay.”

How things have changed since then! Today, attackers make far more through double extortion: they encrypt the files, and they also steal the data and threaten to publish it. It’s a numbers game. In July 2021, the operators of the REvil ransomware exploited a vulnerability in Kaseya VSA, software used by IT service providers, and demanded $70 million for a universal decryption key. Ransom payments for 2020 were estimated at the time at about $350 million in cryptocurrency.

According to Chainalysis, victims paid a total of about $820 million in 2025, while the number of victims announced by attackers rose by around 50% compared with 2024. Fewer and fewer victims are paying, but the attacks don’t stop.

The result? We don’t just have to worry about state-backed attackers, but also about criminal gangs that some states tolerate. And for an ordinary company, in Europe or anywhere else, the latter are a far more real and immediate danger.

4. Cryptocurrency makes ransomware payments easy

Cryptocurrencies are booming. While skeptics talk about the risks of a “crypto bubble”, criminals happily use them for anonymity, for moving money easily and – as prices rise – as a fast track to wealth.

Before the pandemic, one bitcoin traded at just over $7,000, but when the economy ground to a halt around the world, the price exploded. By December 2020 it had reached $24,000, in April 2021 it peaked at $64,000, and in September 2021, when we wrote this article, it was around $46,000. Since then the price has gone through big drops, but in December 2024 it passed $100,000 for the first time. For criminals who blackmail companies, every price rise is one more incentive to keep attacking.

Of course, rising prices aren’t the only thing that makes cryptocurrencies attractive to criminals. They give anyone involved in a crime an easy way to get paid, far more anonymous than a bank account, because blockchain technology records ownership through hashes of public keys, not through people’s names.

Although there’s an entire industry trying to trace payments made to criminals, they keep inventing new ways to hide the “cash-out”, that is, turning cryptocurrency into money. Some methods are technological; others are the tried-and-tested method of laundering money through the accounts of shell companies. Are there gangs of financial criminals offering their services to cybercriminals for exactly this purpose? Of course there are.

Managed cloud: tell me more →

5. Ransomware attacks happen on devices, not in the cloud

While traditional antivirus hasn’t changed much, network infrastructure certainly has. The cloud – on-premises, hybrid, IaaS, PaaS, containerized applications and much more – has changed work environments beyond recognition since the first antivirus programs were designed. In response, security vendors, old and new, have started using the cloud for defense too. What if you could send all the telemetry from your devices (physical or virtual) to a vendor’s cloud to be analyzed there? The advantage, so the argument goes, is the extra computing power the cloud brings.

It makes sense to use technology where it helps or complements our basic defenses, but the key to device (endpoint) security can’t sit on a remote server or with a remote analyst. When a burglar breaks into your home, the last thing you want is to wait for a police officer somewhere far away to decide whether the burglar should be there or not. By then, the burglar may already have left with your belongings, after doing who knows how much damage.

The same goes for device security. Whether you’re protecting your employees’ Windows or Linux workstations, macOS laptops or personal devices, the IoT equipment in your office or the company’s servers – on premises or in the cloud – the heart of your security solution must be an autonomous agent, installed on every device, that responds to a threat at machine speed.

Encryption speed is a point of pride for ransomware developers: every new service claims to encrypt and steal data faster than the competition. As long as the device can’t react on its own, automatically and almost instantly, the ransomware problem won’t go away. When vendors talk about remediation after 60 seconds or after an hour, they’re talking about a game that’s already over. There’s no remediation when you rely on human effort to defeat attacks that unfold at machine speed.

Don’t despair: the answer still lies in technology

There is hope, though. More and more people understand how this war is won, and that time – or, more precisely, speed – is essential. For too long, attackers have had the element of surprise on their side and have easily beaten defenses that rely either on having seen an attack before or on an analyst to deliver a verdict.

While cybercriminals use modern technologies, many companies still rely only on classic antivirus software, which recognizes malicious programs by their signatures, meaning it only catches threats that are already known.

Despite these security controls, an estimated 9.9 billion malware attacks took place in 2019, compared with 8.2 billion in 2015. For criminals, that’s a huge success; for traditional cybersecurity vendors, clear proof of failure.

How do you protect your company from ransomware in 2026?

Ransomware can’t be stopped easily, but the risk drops sharply with a few basic measures, applied to all computers and servers, not just the “important” ones:

• Prompt updates for operating systems, applications and network equipment (firewalls, VPNs). Computers that no longer receive updates are replaced or isolated.
• Two-step verification (MFA) for email, VPN, remote access and administrator accounts.
• EDR protection, which recognizes suspicious behavior and automatically stops dangerous processes, not just signature-based antivirus.
• Backups that follow the 3-2-1 rule, with at least one offline or immutable copy (one that can’t be changed or deleted) and regularly tested restores. See also Backup as a Service.
• Least privilege: employees don’t work with administrator accounts, and access for people who leave the company is closed immediately.
• Alert employees: most attacks start with an email. See how to avoid falling victim to phishing attacks.
• An incident response plan: who does what, whom you notify and where you restore the data from.

For companies that fall under NIS2 (in Romania, GEO 155/2024), these measures are mandatory, and significant incidents must be reported to DNSC (the Romanian National Cyber Security Directorate): an early warning within 24 hours and a notification within 72 hours.

RezolvIT is an IT outsourcing company used to securing and protecting its clients’ infrastructure: laptops, computers, servers and mobile devices. See also IT security, or ask for a free IT audit to find out how exposed your company is.