Cyber Security Ransomware
Ransomware is malware that encrypts a victim's files or systems and demands payment in exchange for restoring access.
What Is Ransomware?
Ransomware is malware that encrypts a victim's files, or sometimes an entire system, making them unusable, and then demands payment — almost always in cryptocurrency — in exchange for the decryption key needed to restore access. Many modern ransomware operations also steal a copy of the data before encrypting it, then threaten to publish it if the ransom isn't paid, a tactic known as double extortion.
How a Ransomware Attack Typically Unfolds
- Initial access: the attacker gets in, commonly through a phishing email, a stolen or weak remote-access credential, or an unpatched vulnerability.
- Lateral movement: the attacker explores the network and escalates privileges to reach as many valuable systems as possible.
- Data exfiltration: sensitive data is quietly copied out, setting up the 'double extortion' threat.
- Encryption: files across affected systems, and often backups the attacker can reach, are encrypted.
- Ransom demand: a note appears explaining what happened and how to pay, usually with a deadline and a threat to leak data or raise the price.
Common Variants
- Crypto ransomware: encrypts files but leaves the system itself running, so the victim can see the ransom note.
- Locker ransomware: locks the victim out of the entire device or screen rather than targeting individual files.
- Double extortion: combines encryption with a threat to leak stolen data publicly.
- Ransomware-as-a-Service (RaaS): developers rent out their ransomware to other criminal affiliates in exchange for a cut of the profits, which has significantly lowered the skill needed to launch an attack.
Prevention and Recovery
- Keep regular backups that are offline or otherwise isolated (immutable), so ransomware on the network can't reach and encrypt them too.
- Patch operating systems and software promptly, since many attacks start with a known, fixable vulnerability.
- Segment networks so a compromised device can't easily reach every other system.
- Filter email and train staff to recognize phishing, still the most common way ransomware gets its first foothold.
- Apply least privilege, so a compromised account has limited ability to spread or reach sensitive systems.
- Maintain and rehearse an incident response plan so the organization isn't improvising during an actual attack.
No single control stops every ransomware attack, which is why layered defenses matter — but of all of them, tested, offline backups are what most often determine whether an incident is a costly inconvenience or an existential crisis for the organization.
