The SamSam ransomware has always been a bit different. Unlike many ransomware infections, its victims are targeted rather than random — and the attacker establishes a presence on the victim network before beginning the encryption process.

Victims this year include the City of Atlanta, Allscripts, Adams Memorial Hospital, Colorado Department of Transportation and the Mississippi Valley State University. It could seem that SamSam targets health, education and government; but a new and detailed analysis of SamSam from Sophos shows this is not the case — and its success rate is far higher than previously thought.