What is an example of a ransomware attack?

A famous example of a ransomware attack is WannaCry, which spread globally in 2017. It exploited a vulnerability in older Windows systems, encrypting files on hundreds of thousands of computers and demanding payment in Bitcoin to unlock them.

How does ransomware spread?

Ransomware typically spreads through phishing emails containing malicious attachments or links. It can also spread by exploiting unpatched software vulnerabilities, compromised remote desktop protocol (RDP) credentials, or malicious downloads from compromised websites.

Should you pay the ransom?

Law enforcement agencies like the FBI strongly advise against paying the ransom. Paying does not guarantee you will get your data back, it funds future criminal activities, and it marks your organization as a target willing to pay, increasing the likelihood of future attacks.

How can I protect against ransomware?

The most effective defense against ransomware is maintaining regular, offline backups of your critical data. You should also ensure all software is patched, use strong multi-factor authentication (MFA), and train employees to recognize phishing attempts.

What is the difference between ransomware and malware?

Malware is a broad term for any malicious software, including viruses, spyware, and trojans. Ransomware is a specific type of malware designed exclusively to block access to your computer system or files until a sum of money is paid.

Is ransomware a virus?

While people often use the terms interchangeably, ransomware is not necessarily a virus. A virus is malware that infects other files and relies on human interaction to spread. Some modern ransomware, like worms, can spread autonomously across networks without human intervention.

What Is Ransomware and How It Uses Encryption Against You

Introduction

In the modern digital era, data is often an organization’s most valuable asset. When a cybercriminal locks away that data and throws away the key, the consequences are catastrophic. Operations grind to a halt, financial losses mount, and public trust is severely damaged. This devastating scenario is the reality of a ransomware attack, a threat that has escalated from a nuisance into a multi-billion-dollar global criminal enterprise.

For decades, encryption has been the primary mechanism we use to secure our most sensitive information, keeping it safe from prying eyes. However, attackers have turned our strongest defense against us. They weaponize the very cryptographic algorithms designed to protect data, using them to hold systems hostage. Understanding what is ransomware, how it leverages encryption for extortion, and why traditional defenses often fail is critical for anyone responsible for safeguarding digital assets. By examining the mechanics of these attacks, organizations can better prepare, defend, and ultimately survive this pervasive threat.

What Is Ransomware?

Ransomware is a specialized category of malicious software (malware) engineered to deny a user or organization access to files on their computer. By encrypting these files and demanding a ransom payment for the decryption key, cybercriminals effectively hold the victim’s data hostage. Organizations are typically given a strict deadline to pay, often in cryptocurrency like Bitcoin to maintain the attacker’s anonymity. If the deadline passes without payment, the ransom demand may increase, or the data may be permanently destroyed or leaked to the public.

Initially, ransomware attacks were relatively simple, targeting individual consumers with scare tactics. Today, the landscape is dominated by sophisticated organized crime syndicates operating Ransomware-as-a-Service (RaaS) models. In this ecosystem, developers write the malicious code and lease it to “affiliates” who handle the network intrusion and deployment. When a ransom is paid, the developer and the affiliate split the profits. This professionalization has led to a massive surge in targeted attacks against high-value targets like hospitals, schools, and critical infrastructure, where the urgency to restore operations makes them more likely to pay.

Modern ransomware frequently employs a “double extortion” tactic. In addition to encrypting the files, the attackers first exfiltrate (steal) the sensitive data. If the victim refuses to pay for the decryption key—perhaps because they have good backups—the attackers threaten to publish the stolen data on the dark web, triggering massive regulatory fines and reputational ruin.

How Ransomware Works

A ransomware attack rarely happens instantly; it is the culmination of a multi-step intrusion process. Here is how the attack typically unfolds in plain English:

Initial Access: The attacker gains entry to the victim’s network. This frequently occurs through a deceptive phishing email containing a malicious link or attachment. Alternatively, attackers might exploit an unpatched vulnerability in a public-facing server or use stolen credentials to log in via Remote Desktop Protocol (RDP) or a Virtual Private Network (VPN).
Network Discovery and Lateral Movement: Once inside, the attacker quietly explores the network. They search for critical servers, sensitive databases, and, most importantly, the organization’s backup systems. They move laterally from the initial compromised machine to higher-value targets, often seeking to elevate their privileges to a network administrator.
Data Exfiltration: Before initiating any disruptive actions, modern ransomware operators often quietly copy the organization’s most sensitive data. This stolen data serves as leverage for the double extortion threat later in the attack.
Encryption Deployment: The attacker distributes the ransomware executable across the network, positioning it on as many servers and endpoints as possible. They coordinate a simultaneous execution to maximize damage before security teams can respond.
The Encryption Process: When triggered, the ransomware software rapidly encrypts all targeted files using strong cryptographic algorithms — the same AES-256 primitives covered in our encryption explained guide. It typically skips core operating system files so the computer can still reboot and display the ransom demand.
The Ransom Note: After the files are encrypted, the ransomware drops a text file or displays a prominent screen containing the ransom note. This note provides instructions on how to contact the attackers via the dark web, how to purchase cryptocurrency, and the deadline for payment.

A typical ransomware attack involves initial access, lateral movement, data exfiltration, and finally, the encryption of critical files.

Watch this explanation of how ransomware operates and why it has become one of the most lucrative forms of cybercrime.

Ransomware vs Traditional Malware

While ransomware is technically a subcategory of malware, its objectives, behaviors, and impacts differ significantly from traditional malicious software.

Feature	Ransomware	Traditional Malware (Spyware, Trojans)
Primary Goal	Direct financial extortion by holding data hostage.	Covert data theft, system disruption, or establishing a backdoor.
Visibility	Highly visible. The attack announces itself boldly with a ransom note.	Highly stealthy. Designed to remain undetected on a system for as long as possible.
Mechanism	Weaponizes encryption to lock the victim out of their own files.	Uses various techniques (keylogging, unauthorized access) to steal information or control the system.
Target Audience	Increasingly targets large enterprises, governments, and critical infrastructure.	Often targets a broad, unfocused audience to harvest as much data as possible.
Resolution	Requires either paying the ransom (not recommended) or restoring from offline backups.	Requires identifying and removing the malicious files using antivirus or anti-malware tools.

Unlike traditional malware, which might silently sit on a computer stealing passwords for months, ransomware is incredibly loud. The attacker wants you to know they are there because they cannot extort you if you are unaware of the attack. Furthermore, while antivirus software can often remove a traditional Trojan and immediately solve the problem, removing a ransomware executable does absolutely nothing to decrypt the already locked files.

Real-World Use Cases

Ransomware attacks happen daily, but several high-profile incidents have shaped how the world understands and responds to the threat.

In 2017, the WannaCry ransomware worm caused a global crisis. Unlike traditional ransomware that required human interaction (like clicking a phishing link), WannaCry exploited a known vulnerability in the Windows Server Message Block (SMB) protocol. It spread autonomously across local networks and the internet. It crippled the UK’s National Health Service (NHS), forcing hospitals to divert emergency patients because they could not access electronic medical records. WannaCry demonstrated the devastating speed at which autonomous ransomware can cripple critical infrastructure.

The 2021 attack on Colonial Pipeline highlighted the severe real-world consequences of ransomware. Attackers compromised the pipeline company’s IT network using a compromised VPN password. Fearing the ransomware could spread to the operational technology (OT) network controlling the pipeline, the company proactively shut down operations. This resulted in massive fuel shortages and panic buying across the Eastern United States, proving that a digital attack could cause immediate physical and economic disruption.

The MOVEit Transfer data breach in 2023 showcased the dominance of the data extortion model. The Clop ransomware gang exploited a zero-day vulnerability in a popular managed file transfer application. Rather than encrypting files, they simply stole massive amounts of sensitive data from hundreds of organizations simultaneously. They then demanded ransom payments under the threat of leaking the data. This incident proved that attackers do not even need to deploy encryption to execute a highly successful extortion campaign.

Common Mistakes to Avoid

Many organizations fall victim to ransomware because they make critical errors in their security posture and incident response planning.

The most fatal mistake is relying on network-connected backups. Ransomware is specifically designed to seek out and encrypt backup files to ensure the victim cannot easily recover. If your backup drives are continually connected to the network or accessible via the same administrator credentials as the rest of the domain, the ransomware will destroy them alongside the primary data. Organizations must maintain immutable or offline backups that are physically isolated from the production network.

Another frequent error is failing to enforce Multi-Factor Authentication (MFA) on all external access points. Countless devastating attacks begin with an attacker simply logging in through a VPN or RDP portal using a password purchased on the dark web or guessed during a brute force attack. Without MFA to provide a second layer of verification, a compromised password grants the attacker immediate access to the internal network.

Finally, organizations often wait until an attack occurs to develop an incident response plan. Trying to figure out who to call, how to communicate with employees, and whether to engage law enforcement while the network is actively burning is a recipe for disaster. Organizations must have a documented, tested playbook for ransomware response, including criteria for when systems should be immediately disconnected from the internet to prevent further encryption.

Getting Started

Protecting your organization from ransomware requires a proactive, layered defense strategy. You cannot rely on a single security tool; you must assume that an attacker will eventually breach the perimeter.

First, implement the 3-2-1 backup rule. Keep at least three copies of your data, store two backup copies on different storage media, and keep one copy located offsite or completely disconnected from the network (air-gapped). Regularly test restoring from these offline backups to ensure they are viable in an emergency. If you are hit by ransomware, a verified offline backup is your only guaranteed path to recovery without paying criminals.

Second, aggressively patch public-facing infrastructure. Ransomware gangs frequently scan the internet for unpatched VPNs, firewalls, and email servers. Apply security updates immediately, prioritizing systems that face the public internet. Coupled with mandatory MFA for all remote access, this drastically reduces the avenues an attacker can use to gain initial entry.

Lastly, invest in user training and endpoint detection. Because phishing remains a primary entry vector, employees must be trained to recognize suspicious emails. Deploy Endpoint Detection and Response (EDR) software on all workstations and servers. Unlike traditional antivirus, EDR monitors for suspicious behaviors—like an unknown program rapidly encrypting hundreds of files—and can automatically halt the process before the damage spreads. For further reading, learn about how brute force attacks work to guess credentials, or explore what is data security to understand the broader context of protecting your organization’s digital assets.