Cyberattacks, Data Encryption, Extortion - How Cybercriminals Operate | DW Documentary

Why It Matters

Ransomware’s evolution into a service‑driven crime economy means any organization with internet‑connected assets faces existential risk, making proactive cyber resilience a board‑level priority.

Key Takeaways

• Ransomware attacks begin with social engineering or vulnerability scanning.
• Double extortion adds data theft to encryption, increasing pressure.
• Companies often lack clean backups, significantly prolonging recovery.
• Hackers operate like businesses with HR, pay, and rules.
• Undercover investigations can expose ransomware groups and aid law enforcement.

Summary

The DW documentary examines how modern ransomware gangs infiltrate corporate networks, extort victims, and monetize stolen data, using the 2025 Bosard Farbin plant breach and the LockBit syndicate as illustrative case studies. It details the two primary entry vectors—phishing‑style social engineering and automated scanning for unpatched services—followed by privilege escalation that enables mass encryption and the newer "double extortion" tactic of exfiltrating sensitive files before locking them.

The film highlights the staggering financial stakes: attackers demand half‑a‑million dollars in Bitcoin, while global ransomware losses exceed $1 billion annually. Victims often discover that backups are also compromised, forcing crisis teams to scramble for the most recent clean snapshot. The narrative underscores the professionalization of cybercrime, noting that ransomware outfits maintain HR departments, payroll cycles, and even geopolitical rules that spare former Soviet states.

Key moments include John Deaggio’s undercover infiltration of LockBit, his 70‑page dossier that triggered worldwide law‑enforcement attention, and the eventual indictment of the group’s Russian leader. Bosard Farbin’s IT staff endured sleepless nights, emotional distress, and a race against a 12‑day ransom deadline, ultimately restoring a seven‑day‑old backup after forensic analysis traced the breach to a weak remote‑access credential on a forklift terminal.

The documentary warns that ransomware is no longer a fringe threat but a structured industry demanding robust cyber hygiene, segmented network architectures, and immutable backup strategies. For executives, the cost of prevention—regular patching, employee training, and zero‑trust controls—remains far lower than the operational and reputational damage of a successful attack.

Original Description

Ransomware poses an existential threat to businesses. It's a form of cybercrime that's a highly professional industry. The criminals operate like a business - by infiltrating systems, encrypting data, and extorting money.

Those who refuse to pay, face operational shutdown, loss of data, and bankruptcy. Many criminal groups have a division of labor that's similar to that of companies, with teams of developers, negotiators, 'customer support,' and clear deadlines. This documentary shows how almost any company can be targeted and how quickly an attack can threaten the very survival of the business. In the spring of 2025, Philipp Bosshard’s company was hit. It wasn't just the IT system that went down, the entire company ground to a halt. The future of the business and the jobs of its 200 employees were at stake. The hackers set a deadline: Bosshard had twelve days to decide whether to pay the ransom or see if he could somehow find another solution.

The documentary also tracks the cybercriminals themselves. Through months of undercover investigations, cybersecurity analyst Jon DiMaggio managed to infiltrate one of the most notorious ransomware gangs: Lockbit. He even engaged with the group's mysterious leader, who went by the name "LockbitSupp" - befriending him and ultimately unmasking his identity.

When Lockbit itself was hacked in 2025, the inner workings of the gang were laid bare. Data journalist Simon Huwiler analyzed the leaked data and stumbled on one unusually large ransom payment, with a trail leading to Switzerland...

#documentary #dwdocumentary #dwdocs

______

DW Documentary gives you knowledge beyond the headlines. Watch top documentaries from German broadcasters and international production companies. Meet intriguing people, travel to distant lands, get a look behind the complexities of daily life and build a deeper understanding of current affairs and global events. Subscribe and explore the world around you with DW Documentary.

Subscribe to: ‬

⮞ DW Documentary (English): https://www.youtube.com/@DWDocumentary

⮞ DW Documental (Spanish): https://www.youtube.com/@DWDocumental

⮞ DW Documentary وثائقية دي دبليو (Arabic): https://www.youtube.com/@DWDocarabia

⮞ DW Documentary हिन्दी (Hindi): https://www.youtube.com/@DWDochindi

⮞ DW Dokumenter (Indonesian): https://www.youtube.com/@DWDokumenter

⮞ DW Doku (German): https://www.youtube.com/@DWDoku

For more visit: http://www.dw.com/en/tv/docfilm/s-3610

Follow DW Documentary on Instagram: https://www.instagram.com/dwdocumentary/

Follow DW Documental on Facebook: https://www.facebook.com/dwdocumental

We kindly ask viewers to read and stick to the DW netiquette policy on our channel: https://p.dw.com/p/MF1G