What ransomware is
Ransomware is malicious software that makes your data or systems unusable and then demands payment, usually in cryptocurrency, to restore access. Most often it works by encrypting files, which means scrambling them with a secret key so they cannot be opened without it. The attackers hold the key, and the ransom note offers to sell it.
Some groups now also steal copies of the data before encrypting it and threaten to publish it if no payment is made. This is sometimes called double extortion, and it means that restoring from backup solves the availability problem but not the privacy one.
How the encryption works, briefly
Ransomware generally uses the same kind of strong encryption that protects legitimate data. Files are scrambled with a key, and that key is itself protected so that only the attacker can unlock it. Because the math is sound, victims cannot usually guess or break their way back in. Occasional flaws in a particular ransomware family have let researchers build free decryption tools, but this cannot be counted on. That is why prevention and backups matter far more than hoping for a fix afterward.
How infections start
- Phishing. A deceptive email or message with a malicious attachment or link remains a leading route.
- Exposed remote access. Remote desktop and similar services reachable from the internet, protected by weak or reused passwords, are a frequent entry point for attacks on organizations.
- Unpatched software. Known flaws in internet-facing systems, VPN appliances or file-transfer tools allow attackers in.
- Stolen credentials. Passwords from earlier data breaches, or captured by infostealer malware, are sold and reused.
- Malicious downloads. Pirated software, fake updates and compromised ads can deliver malware.
- Trusted third parties. A compromised service provider can pass the problem on to its customers.
In many organizational attacks, the ransomware itself is the last step. Attackers may spend days inside a network first, finding the backups, gaining administrator rights and disabling security tools, then trigger encryption across many machines at once.
Who is affected
Individuals, schools, hospitals, local governments, small businesses and large companies have all been hit. Attackers often favor organizations that cannot tolerate downtime, because that raises the pressure to pay. Small organizations are not safe by being small; automated scanning finds weak systems regardless of size.
Prevention
No single step is enough, so the following work together.
Keep software updated. Apply operating system, browser and application updates promptly, and prioritize anything reachable from the internet. Retire software that no longer receives fixes.
Secure sign-in. Use unique passwords, store them in password managers, and turn on two-factor authentication, especially for email, remote access and administrator accounts. Do not leave remote desktop open to the whole internet.
Be careful with messages. Treat unexpected attachments and links with suspicion. Disabling macros by default in office documents removes a historic route for malware.
Limit what an infection can reach. Use ordinary accounts for daily work rather than administrator accounts. Restrict shared folder access. In organizations, segment the network so one infected computer cannot touch everything.
Use security software and monitoring. Modern endpoint protection looks for behavior such as a program rapidly rewriting many files. Organizations benefit from alerts that someone actually watches, including outside of business hours.
Reduce the damage of stolen data. Collect and keep only what is needed, and encrypt sensitive information, so a data theft is less harmful.
Backups: the central defense
If you can restore everything from a clean copy, a ransomware attack is an expensive nuisance rather than a catastrophe. A few principles are widely recommended.
- Keep several copies. A common rule of thumb is three copies of important data, on two different kinds of storage, with one stored somewhere separate.
- Make at least one copy hard for malware to change. Ransomware searches for connected drives, network shares and cloud-synced folders and encrypts them as well. An offline copy, or storage with settings that prevent changes or deletion for a set period, survives this. A drive that sits permanently plugged in is exposed.
- Be careful with file syncing. Sync services mirror changes, including encrypted files. Many offer version history that lets you roll back, but check how long it is kept and how it works rather than assuming.
- Test restoring. A backup you have never restored is an assumption. Practice recovering real files, and for organizations, time how long a full recovery takes.
- Protect the backup system. Use separate credentials for it, since attackers specifically target backups.
These points are covered in more depth in discussions of how and why data backups fail, but the key idea is simple: the backup must be separate, current and proven.
If you are hit
- Disconnect the affected device from the network and Wi-Fi to limit spread. Do not necessarily power it off in a business setting without advice, since some evidence may be lost; follow your incident plan.
- Do not delete the ransom note or files. They help identify the variant and investigators may need them.
- Tell the right people. At work, report to IT or security immediately. Consider contacting the relevant authorities; many countries have a reporting service, and organizations may have legal notification duties if personal data was involved.
- Identify the scope. Which systems are affected, and are backups intact?
- Check for free decryptors. Reputable projects maintain lists of tools for specific ransomware families, but only some families are covered.
- Rebuild cleanly. Restore from a clean backup onto systems that have been cleaned or rebuilt, and change all passwords. Restoring onto a still-infected system just repeats the problem.
- Close the entry point. If you do not find how attackers got in, they may return.
Whether to pay
Authorities and many security professionals generally advise against paying. Payment funds further attacks, and it does not guarantee that you receive a working key or that stolen data is deleted. Some victims who paid still had to rebuild much of their systems. Others weigh severe consequences, such as threats to life or an organization’s survival, and decide differently; in some places, paying certain groups may be restricted by sanctions rules. This is a decision that ought to involve legal counsel, insurers where applicable, and law enforcement guidance, rather than being made in a panic.
A realistic outlook
Ransomware has been a persistent problem for years, and tactics shift as defences improve. There is no way to promise immunity. What does work is a combination of fewer weak points, early detection and backups you have tested. Preparing before an attack is far cheaper and calmer than improvising during one.