Ransomware is a category of malware that denies victims access to their data or systems, usually by encrypting files, and then demands payment, typically in cryptocurrency, in exchange for a decryption key. Among malware and attacks in cybersecurity, modern ransomware is less a single program than an extortion operation: attackers first break into a network, spread through it, steal data and only then deploy encryption across as many systems as possible.
Many current campaigns use double extortion, threatening to publish stolen data if the ransom is not paid, so that even organizations with good backups face pressure. The impact ranges from a few encrypted laptops to the complete shutdown of hospitals, factories and public services for weeks.
How a ransomware attack unfolds
Targeted ransomware attacks follow a recognizable sequence of stages. The encryption itself often happens in hours, but the preceding intrusion may last days or weeks, which gives defenders their best chance to detect it.
| Stage | Attacker activity | Defensive opportunity |
|---|---|---|
| Initial access | Phishing, stolen credentials, exposed RDP or VPN flaws | Multi-factor authentication, patching |
| Persistence and discovery | Remote tools installed, network and accounts mapped | Endpoint detection, unusual logon alerts |
| Privilege escalation | Domain administrator rights obtained | Least privilege, tiered admin accounts |
| Lateral movement | Spread to servers and backup systems | Network segmentation, monitoring of admin tools |
| Exfiltration | Large data volumes copied out | Egress monitoring and data loss alerts |
| Impact | Backups deleted, shadow copies removed, files encrypted | Immutable offline backups, rapid isolation |
Encryption usually combines a fast symmetric cipher such as AES or ChaCha20 for file contents with the attacker’s public key to protect the per-file keys. Without the private key, properly implemented encryption cannot be reversed, which is why recovery depends on backups or on flaws in the malware.
Types of ransomware and extortion models
Ransomware has evolved from indiscriminate mass infections to targeted operations that set ransoms according to the victim’s revenue.
| Type | How it works | Main pressure on the victim |
|---|---|---|
| Crypto ransomware | Encrypts files and databases | Loss of access to data |
| Locker ransomware | Locks the screen or device | Device unusable, data often intact |
| Double extortion | Steals data, then encrypts | Threat of publication |
| Data extortion only | Steals data without encrypting | Threat of leak and regulatory exposure |
| Wiper disguised as ransomware | Destroys data with a fake ransom note | No recovery possible even after payment |
Most large campaigns run as Ransomware-as-a-Service (RaaS). A core group develops the malware, payment portal and leak site, while affiliates carry out intrusions and share the proceeds. This division of labor explains why the same malware family appears with very different intrusion techniques.
Ransomware compared with related threats
Ransomware is defined by its extortion goal, not by a specific technique, and it usually relies on other attack types along the way.
| Threat | Primary goal | Relationship to ransomware |
|---|---|---|
| Phishing | Obtain credentials or run code | Common initial access method |
| Credential stuffing | Reuse leaked passwords | Opens VPN or remote access accounts |
| Trojan | Hidden malicious functionality | Loaders that later deliver ransomware |
| Botnet | Control many infected machines | Sells access to ransomware affiliates |
| Rootkit | Hide attacker presence | Occasionally used to evade detection |
Prevention and resilience measures
Effective defense combines reducing the chance of intrusion with limiting the damage when an intrusion succeeds. No single control is sufficient, because attackers adapt to the weakest point.
- Enforce phishing-resistant multi-factor authentication on remote access, email and administrator accounts.
- Patch internet-facing systems first, especially VPN gateways, firewalls and file transfer servers.
- Keep offline or immutable backups following the 3-2-1 principle, and test restores regularly.
- Separate backup credentials from the main domain so that attackers cannot delete backups.
- Segment networks and restrict administrative protocols such as RDP, SMB and PowerShell remoting.
- Deploy endpoint detection and response and monitor for mass file changes and shadow copy deletion.
Backups alone do not solve double extortion, because stolen data can still be published. Reducing the amount of sensitive data stored, encrypting it at rest and monitoring outbound transfers address the exfiltration stage directly.
Responding to an attack and the question of payment
The first hours of response determine how far the damage spreads. Affected systems should be isolated from the network but not powered off, because memory may contain keys or evidence.
| Decision | Recommended approach | Reason |
|---|---|---|
| Containment | Disconnect affected segments, disable compromised accounts | Stops further encryption and spread |
| Recovery source | Restore from verified clean backups | Avoids reintroducing the attacker |
| Payment | Avoid where possible, involve legal counsel and authorities | No guarantee of working keys or data deletion |
| Notification | Assess regulatory and contractual duties early | Data protection laws often set short deadlines |
| Root cause | Find and close the initial access path | Repeat attacks are common otherwise |
Paying a ransom is legally restricted in some cases, for example when the recipient is under sanctions, and it funds further attacks. Even after payment, decryption tools are often slow or faulty, so restoring large environments can still take weeks rather than days.
Understanding it simply
Ransomware is digital kidnapping of data. Criminals sneak into a computer network, lock the files with a code only they know, and demand money for the key. Often they also copy the files first and threaten to publish them.
The best protection is a mix of good locks and good copies: strong logins and updates keep intruders out, while safe backups stored out of reach mean that locked files can be restored without paying.
Applied in practice
A regional manufacturing company with about 400 employees discovers on a Monday morning that its file servers and production planning system are encrypted. The investigation shows that attackers logged in through a VPN account without multi-factor authentication three weeks earlier, obtained administrator rights and copied around 300 GB of engineering and payroll data before deploying ransomware over the weekend.
Because the company kept immutable backups in a separate cloud account with its own credentials, the attackers could not delete them. The IT team, supported by an incident response provider, rebuilds the domain and restores core systems within six days without paying. The stolen data still requires notification of employees and authorities, and the company adds multi-factor authentication to all remote access and egress monitoring to prevent a repeat.