Ransomware

What ransomware does

Ransomware is malicious software that encrypts files so you cannot open them, then demands a payment, usually in cryptocurrency, for the key. Since around 2019 most big gangs also steal a copy of the data first and threaten to publish it, so even victims with good backups face pressure to pay. This is called double extortion.

Home users can be hit, but the main targets are organizations that cannot afford downtime: hospitals, schools, local governments, manufacturers and small businesses.

How an attack usually unfolds

1. Initial access. A phishing email, a stolen password for a remote-access service (VPN or Remote Desktop) without two-factor authentication, or an unpatched internet-facing system.
2. Quiet expansion. Attackers spend days or weeks moving through the network, collecting admin passwords and finding the most valuable data.
3. Disabling defenses. They try to switch off antivirus and delete or encrypt any backups they can reach.
4. Theft and encryption. Data is copied out, then encryption runs across as many machines as possible, often at night or over a holiday weekend.
5. The ransom note. A message with a deadline and a link to a negotiation site.

Many gangs run a business model called ransomware as a service: developers build the tool and "affiliates" carry out attacks in exchange for a share of the ransom. That is why the same malware family can show up in very different attacks.

Prevention that actually works

• Backups attackers cannot reach. Keep at least one copy offline or immutable (it cannot be changed or deleted for a set time). Test restoring from it. See backups and the 3-2-1 rule.
• Patch quickly, especially VPNs, firewalls and anything reachable from the internet. See software updates.
• Two-factor authentication on all remote access and email.
• Least privilege: everyday accounts should not be administrators.
• Endpoint protection such as Microsoft Defender, kept switched on, with tamper protection enabled.
• Training so staff recognize phishing and report it fast.

If ransomware hits

1. Disconnect affected devices from the network (unplug the cable or turn off Wi-Fi). Avoid powering them off if you can, as memory can hold useful evidence.
2. Do not delete the ransom note or the encrypted files.
3. Call for help: your IT provider or your cyber insurer's hotline. In the US report to the FBI at ic3.gov and to CISA; in the UK to Action Fraud and the NCSC.
4. Check for a free decryptor at nomoreransom.org, a project run by law enforcement and security companies.
5. Restore from clean backups only after the attacker's access is removed, or they will simply encrypt again.

Home users

For individuals the main risk is losing photos and documents. Turn on cloud backup (iCloud, Google One or OneDrive) and keep an occasional copy on an external drive that you unplug afterwards. Keep your devices updated and do not install "cracked" software or game cheats, which are common ways ransomware and other malware spread.