logo

Dr Joseph L Popp Jr and The First-Ever Ransomware – The AIDS Trojan

ID: 60fd752e-f15e-533f-8afa-8826a83bcd10

STIX ID: report--60fd752e-f15e-533f-8afa-8826a83bcd10

Feed Name: WatchGuard Secplicity Blog

Threat Score
10/100

Date Published: 2025-02-18

Date Updated: 2026-05-01

Author: Ryan Estes

...
...

This article is a systematic literature review of the 1989 AIDS Trojan—the first-known ransomware—detailing how evolutionary biologist Joseph Popp distributed infected 5.25-inch floppy disks to researchers, the ransom demands, his subsequent behavior and legal outcome, and the wider historical impact on modern ransomware; the author builds on research for WatchGuard's Ransomware Tracker to aggregate artifacts and evidence to examine motivations, technical behavior, and legacy.

Your team is not currently subscribed to this feed. You must subscribe to it in order to see this post.