Ransomware Awareness in Digital Era

This paper has developed an integrated, dual-track analysis of ransomware as a threat that operates simultaneously at the macro level of organizational and global dynamics and at the micro level of individual knowledge, behaviour, and institutional training. The survey data makes the individual-level picture concrete: 56.7% correct on definition, 26.7% confident in incident response, 36.7% using MFA on all accounts, 40% backing up rarely or never. These are not abstract statistics—they describe the knowledge and behavioural state of individuals who will shortly enter India's IT workforce. The threat intelligence sources paint the context they will enter: ransomware in 44% of all confirmed breaches globally [1], a 50% surge in claimed victims [2], India's recovery times worsening against global trends [3], and a criminal ecosystem of 85+ active groups increasingly targeting smaller, faster-paying organizations including academic institutions [2]. The structural argument of this paper is that these two pictures are causally connected: individual knowledge gaps aggregate into the organizational expertise deficits that threat intelligence sources document as the leading cause of victimization. Addressing the macro problem requires closing the micro gap first. The defence framework in Section VII translates this analysis into actionable steps. Mandatory training, universal MFA, the 3-2-1-1-0 backup standard, simulated phishing programs, structured incident response planning, and automated patch management are not novel concepts—but they remain incompletely implemented in the academic settings reached by this survey. The 70% of respondents who believe more cybersecurity education is definitely needed are correct. Acting on that consensus is the most impactful step available to Indian academic institutions today. Future research should extend this survey to a larger, geographically representative national sample; develop pre/post training assessments to measure whether interventions close the gaps identified here; and investigate whether the faculty-level awareness deficit observed is representative of a broader institutional pattern.

[1] C. D. Hylender, P. Langlois, A. Pinto, and S. Widup, “2025 Data Breach Investigations Report,” Verizon Business, 2025. [2] Chainalysis Inc., “The 2026 Crypto Crime Report,” Chainalysis, March 2026. [3] Sophos Ltd., “The State of Ransomware in India 2025,” Sophos Whitepaper, June 2025. [4] A. Young and M. Yung, “Cryptovirology: Extortion-based security threats and countermeasures,” in Proc. IEEE Symposium on Security and Privacy, Oakland, CA, 1996, pp. 129–140. [5] H. Oz, A. Aris, A. Levi, and A. S. Uluagac, “A Survey on Ransomware: Evolution, Taxonomy, and Defence Solutions,” ACM Computing Surveys, vol. 54, no. 11, pp. 1–37, 2022. [6] P. Rajivan and C. Gonzalez, “Creative Persuasion: A Study on Adversarial Behaviours and Strategies in Phishing Attacks,” Frontiers in Psychology, vol. 9, p. 135, 2018. [7] J. M. Blythe, L. Coventry, and L. Little, “Unpacking Security Policy Compliance: The Motivators and Barriers of Employees’ Security Behaviours,” in Proc. Symposium on Usable Privacy and Security (SOUPS), Ottawa, Canada, 2015, pp. 103–122. [8] Cybersecurity and Infrastructure Security Agency (CISA), “ Guide,” CISA, Washington, D.C., 2023. [Online].         Available: https://www.cisa.gov/stopransomware/ransomware-guide [9] S. Rose, O. Borchert, S. Mitchell, and S. Connelly, “Zero Trust Architecture,” NIST Special Publication 800-207, National Institute of Standards and Technology, Gaithersburg, MD, 2020. [10] Sophos Ltd., “The State of Ransomware 2025,” Sophos Whitepaper, June 2025.