Skip to content
Getting Digital
Contact

Ransomware

Also: crypto-ransomware, double extortion, ransomware attack, data extortion

Ransomware is an attack in which criminals gain access to an organisation's systems, encrypt or steal its data, and demand payment to restore access or withhold publication.

Assessment. Ransomware is not a malware problem; it is an access problem with malware at the end. By the time files are encrypting, the attacker has typically been inside for days, has found and destroyed the backups, and has copied the data. The organisations that recover well are the ones whose backups could not be reached from the network and whose plan was rehearsed. Everything else is negotiation.

The popular picture is a user opening an attachment and every screen going dark at once. The modern reality is slower and worse. An attacker gets in, often through a phished credential, an exposed remote access service or a known flaw on an internet-facing system. They spend days or weeks moving through the network, escalating privileges, finding the backup servers and the file shares, and copying out the data they will threaten to publish. Only then, usually at a weekend or a holiday, do they deploy the encryption, having first deleted or encrypted the backups they found. The encryption is the last step of a long intrusion, and the defences that matter are the ones that interrupt the earlier steps or survive the last one.

StageWhat the attacker doesWhat stops or limits it
Initial accessPhishing, exposed remote access, an unpatched public systemPhishing-resistant MFA, no exposed remote desktop, patching exposed systems first
Escalation and movementSteals more credentials, becomes an administrator, maps the networkLeast privilege, time-boxed admin rights, internal segmentation, endpoint detection
ExfiltrationCopies out the data to threaten publicationEgress monitoring, data classification, knowing what left
Destroying recoveryDeletes or encrypts backups reachable from the networkBackups the network cannot write to: offline, immutable, or in a separate account
EncryptionDeploys the payload everywhere at onceDetection and response fast enough to isolate; otherwise, the backups
ExtortionDemands payment; threatens to publishA rehearsed decision, legal advice, and the knowledge of what was taken

Double extortion, the theft before the encryption, changed the arithmetic. An organisation with perfect backups can restore its systems and still face publication of its customers' data, so the backup is no longer the whole answer; it is the answer to half the problem. The other half is knowing what left, which requires logging that most organisations do not have, and the notification obligations that follow, which are set by regulation rather than by the attacker's timetable. The management-level security credentials examine ransomware as a governance question for exactly this reason: who decides, who is told, what was promised to customers about their data.

In practice

A manufacturer's finance server is encrypted on a Saturday morning along with the file server and the backup server, which sat on the same network with a shared administrator account. The ransom note names the data taken. The company has a second backup: a nightly copy pushed to cloud storage under a separate account whose credentials the network never held, with retention that prevents deletion for thirty days. Restoration takes four days and no payment. The publication threat remains, and the company's legal team, following a plan rehearsed the previous spring, notifies the regulator inside the deadline and its customers the same week. A neighbouring firm hit by the same group, with backups on the same network as its servers, pays.

  • Same network, shared admin account: backups encrypted with everything else.
  • Separate account, retention lock: restored in four days, no payment.
  • Either way: the publication threat and the notification deadline remain.

Often confused with

Phishing
Phishing is one of the commonest ways ransomware operators get in. It is the door; ransomware is what they do after walking through it, and many phishing attacks end in fraud rather than encryption.
Incident Response
Ransomware is the incident; incident response is the process for handling it. The payment decision, the notifications and the recovery order all belong to the response plan, which is why the plan has to exist before the note does.
Encryption
Ransomware uses the same encryption that protects data, turned against its owner. The mathematics is identical; the difference is who holds the key.

Key takeaways

  • →Encryption is the last step of a long intrusion; the earlier steps are where prevention lives.
  • →Backups the network cannot reach are the whole recovery story; backups on the network are the attacker's first target.
  • →Double extortion means restoring systems solves half the problem; knowing what left is the other half.

Related concepts

  • RelatedIncident Response

    The incident type that most tests a response plan and its backups.

  • RelatedPhishing

    Phishing is the most common entry route for a ransomware attack.

Where this concept sits in the field

Certifications that test this

Vendor exams whose syllabus covers this concept: facts, cost and a preparation path on each page.

More courses from these categories

Courses from the categories where this concept is taught. Details, price and the provider link are on each course page.

Blockchain and Healthcare

Udemy

PMP (Project Management Professional)- Exam Preparation 2025

Udemy

Intro to Cybersecurity in Healthcare (1 of 2),Plain & Simple

Udemy

Microsoft Teams Management: MS-700 Practice Exam Unofficial

Udemy

IT Networking Fundamentals For Complete Beginners

Udemy

Agile Scrum Master Certification: Scrum Project Management

Udemy

FAQ

Should an organisation pay the ransom?
That is a leadership decision, ideally made in principle before an attack and taken with legal advice during one, since payment to some groups is unlawful in some jurisdictions and payment does not guarantee working decryption or deletion of stolen data. The technical goal is to make the question irrelevant by having backups the attacker could not reach.
Will antivirus stop ransomware?
It stops many known payloads and is worth having. It does not stop the intrusion that precedes the payload, which uses legitimate credentials and legitimate tools, and by the time a payload runs the attacker has usually disabled or evaded the protection. Prevention lives in identity, patching and segmentation; recovery lives in backups.
What makes a backup ransomware-proof?
The network cannot write to it, or cannot delete from it. Offline media, storage in a separate account with credentials the production network never holds, or storage with enforced retention that prevents deletion for a fixed period all qualify. A backup server on the same network with a shared administrator account does not, and that is the commonest arrangement.

Sources

The primary text this definition rests on. Read it before relying on this one.

  • CISA, #StopRansomware Guide (2023)
  • NIST SP 1800-25, Data Integrity: Identifying and Protecting Assets Against Ransomware and Other Destructive Events (2020)
  • NIST SP 800-61 Rev. 2, Computer Security Incident Handling Guide (2012)

Last reviewed 13 September 2026 · Getting Digital