LockBit Ransomware is a russian made ransomware that emerged in 2019. It is a RaaS (Ransomware as a Service). It is a ransomware that is well known for its speed in encrypting files, and it has been involved in many high profile attacks. A recent attack was on the UK Post Office in January 2023, where the operators of this attack were demanding a ransom fee of ~£62 million. LockBit has recently been being watched by the NCA, many of their leak sites have been going down, and the NCA have been working with the FBI and many other agencies to take down the operators/developers of this ransomware. LockBit is known for using a double extortion method, where they will encrypt the company's files, while also stealing the sensitive information from their systems, and threatening to release it on one of their leak sites, unless they receive the ransom fee. LockBit has had 2 major versions, LockBit 2.0 (which was in 2021), and LockBit Black (or LockBit 3.0, which was released in 2022). This Github page has more information on how LockBit works, and how the operators or developers go about operating this ransomware. (Note: Do not run this without a virtual machine).

WannaCry is one of the most well known ransomwares in the world, it was first seen in 2017, and it was a ransomware that worked a bit like a worm, it could self replicate and spread. It didn't require an operator to deploy it, as it was a bit like a worm-ransomware hybrid. WannaCry exploited a vulnerability in the Windows SMB protocol (EternalBlue), which was a vulnerability that was found by the NSA. The vulnerability was leaked by a group called the Shadow Brokers, and it was then used in the WannaCry Ransomware.

REvil Ransomware was a RaaS that was known for its high-profile attacks in 2019 to 2021. By using data theft, double-extortion, and strong encryption, it allowed affiliates to spread the malware while its developers kept a portion of the earnings. The gang targeted businesses globally, created major disruptions, and was ultimately taken down by coordinated international law-enforcement action.

Conti was a major ransomware organisation active from about 2020 to 2022, known for fast network-wide propagation, data theft, and strong double-extortion techniques. Conti operated more like a structured cybercrime organisation with salaried employees, internal training, and rigid duties than many RaaS crews. They targeted governments, hospitals, and huge corporations, creating major disruptions before the group disintegrated following internal leaks and external pressure.

DarkSide was a ransomware group active mainly in 2020–2021, notable for highly focused operations and a sophisticated ransomware-as-a-service system. They targeted big businesses, pressuring victims through double-extortion and data theft. The gang became globally known after the Colonial Pipeline disaster, which received considerable law-enforcement attention and finally prompted the operators to shut down their infrastructure and operations.

RedLine Stealer is a widely spread credential-stealing malware that focuses on collecting sensitive information rather than encrypting systems. Once installed, it captures browser-stored passwords, cookies, autofill data, crypto wallet information, and system fingerprints, then delivers everything to a C2 Server. Due to it being frequently offered as a subscription service on black market forums, low-skilled threat actors frequently use it to steal credentials and breach accounts.

Emotet is a modular malware family first created as a banking trojan but eventually evolved into a highly versatile loader and credential stealer. It spreads largely through malicious emails and documents, then collects system info, stolen credentials, and network details before downloading more payloads. Emotet worked as a delivery mechanism for other large malware families, making it one of the most durable and costly botnets until repeated international takedowns halted its activities.

The information-stealing malware Azorult is well-known for quickly harvesting system information, browser data, crypto wallets, and login credentials. Usually, it gets in using exploit kits, phishing emails, or cracked software downloads. After that, it silently exfiltrates the stolen data to a C2 Server. It’s lightweight, fast, and offered on underground marketplaces, making it a favourite choice for attackers who want rapid credential theft and surveillance.

TrickBot originated as banking malware but expanded into a sophisticated modular stealer and botnet architecture. It spreads by phishing, exploit kits, and other malware loaders, then collects credentials, browser data, network information, and domain details while keeping persistent access. Its modular design let operators add additional capabilities over time, and it typically worked with other big malware families, making it a crucial weapon in large‑scale cybercrime operations until many takedowns degraded it.

ILOVEYOU was a fast‑spreading email worm introduced in 2000 that infected millions of Windows systems worldwide. It arrived as a message with the subject “ILOVEYOU” and an attached VBS script that, when opened, overwrote files, stole credentials, and it would then spread by sending the same phishing email to all the contacts on the victims machine. Its simplicity and social‑engineering seduction made it one of the most devastating and significant malware outbreaks in history.

The Israeli company NSO Group created the sophisticated mobile spyware toolkit Pegasus, which is supplied to governments for focused monitoring. Through zero-click attacks, it can infect phones, providing operators with deep access to calls, texts, location data, microphone, and camera activity. Pegasus is designed for covert intelligence gathering, and investigations have showed it being used against journalists, activists, politicians, and other high‑value targets, creating significant global privacy and human‑rights issues.

Conficker is a computer worm that initially appeared in 2008 and quickly infected millions of Windows PCs worldwide. It propagated through network shares, portable drives, and exploiting a Windows vulnerability, generating a vast botnet. Conficker was known for its advanced evasion strategies, including deactivating security services, restricting access to security websites, and continually updating itself, making it exceedingly difficult to eradicate and a huge cybersecurity threat at the time.

First discovered in 2004, MyDoom is among the fastest-growing email worms ever documented. It arrived through malicious email attachments and, once executed, gathered addresses and transmitted itself to new victims while creating a backdoor on the afflicted PC. One of the most destructive malware outbreaks in history, MyDoom caused significant worldwide disruptions by sending out a lot of emails and performing distributed denial-of-service assaults against selected businesses.

Stuxnet is a highly sophisticated cyberweapon discovered in 2010, meant to target industrial control systems, specifically Iran’s nuclear centrifuges. It used sophisticated rootkit tactics to stay hidden, exploited many zero-day vulnerabilities, and propagated via USB sticks and Windows networks. Stuxnet was the first known malware designed primarily for physical destruction and a turning point in state-level cyberwarfare because its goal was to sabotage equipment while evading detection.