The state of Ransomware in 2015

This Fox-IT report reviews three prominent and active ransomware families—CryptoWall, CTB-Locker, and TorrentLocker—detailing their histories, distribution methods (exploit kits, phishing/spam, malicious attachments), C2 communication (Tor, proxy chains, HTTPS), cryptographic approaches (AES, RSA-2048, Curve25519-related schemes), filesystem/network behaviors (dropping ransom notes, disabling shadow copies, encrypting mapped/network drives), targeted file types, and detection/mitigation recommendations for defenders.