Ransomware
Malware that encrypts an organization's files and systems, and often steals its data, to demand payment for recovering them or for not publishing them.
Pronunciation
What it is
Ransomware is a type of malware that encrypts an organization’s files and systems so they cannot be used, and demands a payment, almost always in cryptocurrency, in exchange for the decryption key.
Today most attacks use double extortion: before encrypting, they steal the data and threaten to publish it if the ransom is not paid. That is why backups alone no longer solve the whole problem.
How it usually happens
- Entry: a phishing email, credentials without MFA, or an unpatched vulnerability in an exposed VPN, firewall or server.
- Lateral movement: the attacker escalates privileges and explores the network, sometimes for days.
- Data theft, and deleting or encrypting the backups it finds.
- Encryption of servers and computers, and a ransom note.
Many groups operate as ransomware as a service (RaaS): some develop the malware and others, the “affiliates”, deploy it for a share of the ransom.
How to protect yourself
| Measure | Why |
|---|---|
| 3-2-1 backups, with one offline or immutable | 3 copies, on 2 different media, 1 off-site. If the attacker cannot delete it, you can recover without paying |
| Test restores | A backup that has never been restored is an assumption |
| Keep internet-facing equipment patched | Known, unpatched flaws are one of the most used entry points |
| MFA on email, remote access and admin accounts | Stops entry with stolen passwords |
| Segmentation and least privilege (Zero Trust) | Limits how far the attack can reach |
| A written, rehearsed response plan | Who decides, who to call and how to isolate, before it happens |
Should you pay?
Authorities such as the FBI and CISA recommend not paying: it does not guarantee you get the data back or that it won’t be published, and it funds new attacks. Before any decision, check the No More Ransom project, which publishes free decryption tools for some ransomware families, and report the attack to the authorities.
Demo example: a company encrypts its daily backups to immutable storage for 30 days and rehearses a restore every quarter. When an office computer gets infected, it isolates the network, restores the file server from the previous day’s copy and is back in operation within hours.
Related terms
- Phishing - One of the most common entry points
- MFA - Prevents a stolen password from opening remote access
- Zero Trust - Segmentation reduces the damage
- Shift Left Security - Fewer vulnerabilities from development onward
Official resources: