Key points are not available for this paper at this time.
Ransomware remains one of the most pervasive and disruptive cyber threats, with modern variants employing advanced techniques such as high-speed multithreaded encryption, obfuscation, and intermittent encryption to reduce detection opportunities and accelerate impact. Despite extensive research into detection and mitigation, few studies have systematically quantified the execution performance and behavioural characteristics of contemporary ransomware families. This paper fills this critical gap through a comprehensive, rigorous analysis of 29 active crypto-ransomware strains executed under controlled, isolated conditions.Two purpose-built datasets were developed: one, a verified ransomware corpus of the most active families, and the other, a structured target dataset emulating enterprise file systems. Controlled executions of each ransomware sample provided robust measurements of total execution time, pre-encryption delay, and encryption performance. Key findings include wide variation in encryption speeds (33 MB/s to 2.79 GB/s), distinct preparatory and encryption sequences, and frequent use of intermittent encryption to maximise throughput and evade detection.This research presents the first contemporary academic reproducible benchmark of ransomware execution performance. Through the release of these curated datasets and detailed empirical measurements, it addresses a critical gap in understanding ransomware behaviour. The study contributes a publicly accessible ransomware sample dataset, a structured benchmarking dataset, and a comparative performance analysis across major ransomware families. These results reveal how modern ransomware balances speed, stealth, and efficiency, highlighting the rapidly shrinking window for detection and response. The work establishes a rigorous benchmark for advancing research and practical defence development.
Davies et al. (Wed,) studied this question.