Show several blackmail families from the theft and blackmail incidents of major groups and organizations. Technical display analysis (1) Target Ransom uses DLL injection (2) Fileless threats, (3) Use Epplus to avoid malicious methods of security protection mechanisms, (4) Killing and anti-hacking backup methods, (5) Use the OS whitelist to run malicious actions and other intrusion methods. Extend the application of feasible protection technology for disaster reduction and analyze the defects of defense mechanism.