Case Studies

10th May 2018

SamSam Ransomware: What the 2015–2018 Campaign Still Teaches About Modern Ransomware

The SamSam campaign is over, but its deliberate targeting, network compromise and operational disruption still offer important lessons for ransomware response, DFIR and evidence preservation.

By Navid Sobbi, Founder and CEO, NSI Global

PUBLISHED: 10 May 2018 SUBSTANTIVELY UPDATED: 1 October 2026

SamSam ransomware is no longer an active ransomware family. The FBI has stated that the variant has not been seen since the 2018 investigation and indictment that disrupted the campaign. That does not make the case irrelevant.

Between December 2015 and September 2018, the SamSam operators conducted a sustained campaign against hospitals, municipalities, public institutions, transportation organisations and other networks in the United States and Canada. According to the United States Department of Justice, the alleged operators selected targets, conducted reconnaissance, gained unauthorised access through security vulnerabilities and deployed SamSam to encrypt data. The indictment alleged more than US$6 million in ransom payments and more than US$30 million in losses across more than 200 victims.

The significance of SamSam in 2026 is therefore historical and operational. It demonstrated how ransomware could move beyond indiscriminate malware distribution and become a deliberate intrusion in which the attacker first gained access to an organisation, understood the environment and then used encryption to create maximum operational pressure. Modern ransomware has evolved further, often combining encryption with data theft and extortion, but many of the response lessons exposed by SamSam remain directly relevant.

KEY TAKEAWAYS

· SamSam operated from 2015 to 2018 and should not be described as a current ransomware threat.

· The campaign showed the damage possible when attackers deliberately select targets, exploit access weaknesses and encrypt operational systems and backups.

· Current ransomware response should prioritise containment, evidence preservation, forensic analysis, legal and regulatory assessment, and controlled recovery – not improvised attempts to remove malware from the affected host.

· In Australia, ransomware remains a major operational threat even though SamSam itself is historical.

What Was SamSam Ransomware?

SamSam, also known as Samas, was a ransomware family used in a targeted extortion campaign that began in late 2015. Rather than treating every internet-connected system as an equal target, the operators researched organisations and sought access to networks where encryption could cause serious disruption.

The 2018 United States indictment alleged that the operators used online reconnaissance to identify potential victims, accessed systems without authorisation through security vulnerabilities, installed SamSam and encrypted data. Ransom demands were then issued in Bitcoin in exchange for decryption keys.

The victim list is one reason the campaign became so prominent. The Department of Justice identified municipalities, hospitals, public institutions, transportation bodies and other organisations, including the City of Atlanta, the City of Newark, the Port of San Diego, the Colorado Department of Transportation and multiple healthcare entities. These were environments where loss of access to systems could rapidly become an operational crisis rather than merely an IT problem.

Why SamSam Was Different From Opportunistic Ransomware

SamSam is sometimes summarised as an RDP brute-force threat. That is too narrow to serve as the defining explanation of the campaign. The official record describes a broader, more deliberate intrusion process rather than a single universal access method.

The official indictment describes a more deliberate process: reconnaissance, identification of vulnerable organisations, unauthorised access through security weaknesses, deployment of the ransomware and operational timing designed to increase impact. The attackers were also alleged to launch attacks outside normal business hours and to encrypt backups, making rapid recovery more difficult.

That sequence matters. A ransomware event may be the visible end of an intrusion rather than the beginning. By the time files are encrypted, an attacker may already have obtained credentials, traversed systems, accessed administrative tools or identified backup infrastructure. Modern incident response therefore has to answer what happened before encryption as well as what happened after it.

The Scale of the SamSam Campaign

The Department of Justice described the operation as a 34-month international hacking and extortion scheme. The 2018 indictment alleged more than 200 victims, more than US$6 million collected in ransom payments and more than US$30 million in losses. The most recent attack alleged in the indictment occurred on 25 September 2018.

The FBI subsequently stated that the SamSam variant has not been seen since the 2018 investigation and indictment. That point is important for accuracy: organisations in 2026 should not be told that SamSam itself is actively circulating simply because ransomware remains a current threat.

What SamSam Still Teaches About Ransomware in 2026

Ransomware operations have changed substantially since SamSam. Many contemporary incidents include data theft, leak threats, credential abuse, cloud compromise and multiple forms of extortion. Yet the SamSam case still illustrates several principles that remain central to ransomware resilience and response.

Initial access matters. The encryption payload is only one part of the incident. Investigators must determine how the actor entered the environment and whether the access path remains available.
Privileged access magnifies impact. Once attackers can reach administrative systems, file servers, identity infrastructure or backup platforms, the potential blast radius increases dramatically.
Backups are targets. SamSam operators were alleged to encrypt backups. Current guidance continues to emphasise offline, protected and tested backups because accessible backups can be deleted or encrypted during an intrusion.
Timing can be deliberate. The SamSam indictment alleged attacks outside normal business hours, demonstrating why incident detection and escalation cannot depend entirely on office-hours staffing.
Encryption may be the final visible act. Logs, memory, authentication records, endpoint telemetry, network artefacts and cloud records can be essential for reconstructing what preceded the ransom note.
Recovery and investigation must be coordinated. Restoring services quickly is important, but uncontrolled remediation can destroy evidence needed to understand the compromise, meet reporting obligations or support legal and insurance decisions.

Ransomware Remains a Current Australian Threat

SamSam is historical, but ransomware is not. The Australian Signals Directorate described ransomware as the most disruptive cybercrime threat in its Annual Cyber Threat Report 2024–25. ASD’s Australian Cyber Security Centre responded to 138 ransomware incidents during that financial year.

Current ransomware is also broader than file encryption. Australian guidance recognises cyber extortion in which attackers may threaten to publish or sell stolen information even when organisations can restore systems from backup. This means a technically successful recovery does not, by itself, establish that the incident is over.

Australian reporting obligations have also changed significantly since 2018. Under the current ransomware and cyber-extortion payment reporting regime, certain businesses with annual turnover of at least AUD $3 million and responsible entities for specified critical infrastructure assets must report a ransomware or cyber-extortion payment within 72 hours of making the payment, or becoming aware that a payment has been made on their behalf. Organisations should confirm the obligations that apply to their circumstances at the time of an incident and obtain legal advice where required.

What to Do During a Ransomware Incident

An enterprise ransomware incident should not be treated as a routine host-cleanup problem. Safe Mode, System Restore or other improvised remediation steps are not an appropriate default response where systems may contain evidence of a wider compromise. The immediate priority is coordinated containment and evidence-aware response.

Current CISA ransomware guidance recommends identifying affected systems and isolating them, preserving volatile evidence where practicable, collecting system images and relevant logs, identifying accounts and systems involved in the initial breach, and restoring clean systems from protected backups. CISA also notes that powering down a device can destroy evidence held in volatile memory, so isolation decisions should be made deliberately rather than as a reflex.

For Australian organisations, ASD’s ACSC provides ransomware response guidance and a 24/7 cyber security hotline. The Australian Government strongly discourages making ransomware or cyber-extortion payments because payment does not guarantee data recovery, prevent publication or eliminate the risk of further targeting. Payment decisions can also raise sanctions, regulatory, insurance and legal issues and should not be treated as a purely technical decision.

Activate the organisation’s incident response and crisis-management process.
Isolate affected systems in a controlled manner to limit spread while preserving evidence where possible.
Use trusted out-of-band communications if the attacker may be monitoring corporate email or collaboration platforms.
Preserve logs, endpoint data, cloud records, authentication evidence and representative forensic images before they are overwritten.
Identify the likely initial access path and determine whether the attacker still has persistence or valid credentials.
Assess whether information was accessed or exfiltrated, not only whether files were encrypted.
Determine legal, privacy, regulatory, cyber-insurance and contractual notification requirements.
Recover onto a clean environment from verified backups only after the compromise has been sufficiently understood and contained.

Why Digital Forensics Matters After Ransomware

A ransomware incident creates two urgent questions: how to restore operations and how to establish what actually happened. Those objectives overlap, but they are not identical.

Digital forensic incident response can help determine the initial access vector, affected accounts, systems reached by the threat actor, persistence mechanisms, malware activity, lateral movement, data access, possible exfiltration and the chronology of the intrusion. It can also preserve evidence for legal advisers, insurers, regulators, law enforcement and later litigation.

NSI Global’s Digital Forensic Incident Response service supports authorised ransomware, malware, compromised-account and cyber-incident investigations with incident triage, containment, forensic imaging, evidence preservation, artefact recovery, log analysis and reporting. The broader Digital Forensics and Digital Evidence Services capability supports forensic analysis where evidence may later be required for legal, regulatory, insurance or investigative purposes.

For organisations evaluating incident-response capability before an event, see 7 DFIR Capabilities for Cyber Incident Investigations.

Ransomware Response Is an Evidence Problem as Well as an IT Problem

The historical SamSam campaign is a useful reminder that ransomware is not simply malicious software to be removed. The ransom note appears at the end of a chain of events that may include reconnaissance, exploitation, credential use, privilege escalation, access to backups, lateral movement and deliberate operational disruption.

If responders focus only on decrypting or rebuilding the encrypted systems, they may miss the question that matters most: whether the attacker still has access and what information or systems were exposed before encryption began.

The response should therefore preserve enough evidence to establish scope while restoring critical services through a controlled recovery plan. That balance is especially important when the incident may involve personal information, regulated systems, insurance coverage, contractual notification or potential litigation.

Frequently Asked Questions

Is SamSam Ransomware Still Active?

The FBI has stated that the SamSam ransomware variant has not been seen since the 2018 investigation and indictment. SamSam should therefore be treated as a historical ransomware case study, not as a current ransomware family. Ransomware itself remains an active and disruptive threat.

How Did SamSam Infect Organisations?

The 2018 United States indictment alleged that the operators used online reconnaissance, identified vulnerable organisations, gained unauthorised access through security vulnerabilities and then installed and executed SamSam. The campaign should not be reduced to one access method or presented as if every victim was compromised in the same way.

Why Was SamSam So Disruptive?

The operators targeted organisations that depended heavily on networked systems, including hospitals, municipalities and transportation bodies. The indictment also alleged attacks outside normal business hours and attempts to encrypt backups, increasing operational pressure and making recovery more difficult.

Should an Organisation Pay a Ransom?

The Australian Government strongly discourages ransomware and cyber-extortion payments. Payment does not guarantee restoration, prevent stolen information from being disclosed or eliminate the risk of future attacks. A payment decision can also create sanctions, reporting, insurance and legal issues and should be handled with appropriate legal and executive oversight.

What Evidence Should Be Preserved After a Ransomware Attack?

Relevant evidence can include system memory, forensic images, endpoint telemetry, authentication records, firewall and VPN logs, cloud logs, email records, malware samples, ransom notes, indicators of compromise and records showing attacker movement or data access. The appropriate collection depends on the incident and the volatility of the evidence.

Can Digital Forensics Identify How Ransomware Entered a Network?

Often, yes. Forensic analysis can correlate endpoint, network, identity, cloud and application evidence to identify likely initial access, attacker activity and the sequence leading to encryption. The quality of the answer depends heavily on available logging, retention, evidence preservation and whether systems were altered before forensic collection.

What Should Happen Before Systems Are Rebuilt?

Contain the incident, preserve the evidence needed to understand scope, identify compromised accounts and access paths, assess whether the attacker remains present and establish a clean recovery environment. Rebuilding too early can remove artefacts that explain how the intrusion occurred or allow reinfection if the original access path remains open.

The Lasting Lesson From SamSam

SamSam belongs to an earlier phase of the ransomware ecosystem, but the campaign remains valuable because it exposed a principle that has only become more important: ransomware is often the consequence of a broader compromise, not an isolated malware event.

The modern response is therefore not “remove the ransomware and restore the files.” It is to contain the threat, preserve evidence, establish how access was obtained, determine what the actor reached or removed, meet legal and reporting obligations, eradicate persistence and recover from a clean and defensible position.

If your organisation is responding to ransomware, malware or suspected network compromise, contact NSI Global for a confidential DFIR discussion before avoidable remediation steps alter potential evidence.