Also: crypto-ransomware, double extortion, ransomware attack, data extortion
Ransomware is an attack in which criminals gain access to an organisation's systems, encrypt or steal its data, and demand payment to restore access or withhold publication.
Our take. Ransomware is not a malware problem; it is an access problem with malware at the end. By the time files are encrypting, the attacker has typically been inside for days, has found and destroyed the backups, and has copied the data. The organisations that recover well are the ones whose backups could not be reached from the network and whose plan was rehearsed. Everything else is negotiation.
The popular picture is a user opening an attachment and every screen going dark at once. The modern reality is slower and worse. An attacker gets in, often through a phished credential, an exposed remote access service or a known flaw on an internet-facing system. They spend days or weeks moving through the network, escalating privileges, finding the backup servers and the file shares, and copying out the data they will threaten to publish. Only then, usually at a weekend or a holiday, do they deploy the encryption, having first deleted or encrypted the backups they found. The encryption is the last step of a long intrusion, and the defences that matter are the ones that interrupt the earlier steps or survive the last one.
Stage
What the attacker does
What stops or limits it
Initial access
Phishing, exposed remote access, an unpatched public system
Phishing-resistant MFA, no exposed remote desktop, patching exposed systems first
Escalation and movement
Steals more credentials, becomes an administrator, maps the network
Least privilege, time-boxed admin rights, internal segmentation, endpoint detection
Exfiltration
Copies out the data to threaten publication
Egress monitoring, data classification, knowing what left
Destroying recovery
Deletes or encrypts backups reachable from the network
Backups the network cannot write to: offline, immutable, or in a separate account
Encryption
Deploys the payload everywhere at once
Detection and response fast enough to isolate; otherwise, the backups
Extortion
Demands payment; threatens to publish
A rehearsed decision, legal advice, and the knowledge of what was taken
Double extortion, the theft before the encryption, changed the arithmetic. An organisation with perfect backups can restore its systems and still face publication of its customers' data, so the backup is no longer the whole answer; it is the answer to half the problem. The other half is knowing what left, which requires logging that most organisations do not have, and the notification obligations that follow, which are set by regulation rather than by the attacker's timetable. The management-level security credentials examine ransomware as a governance question for exactly this reason: who decides, who is told, what was promised to customers about their data.
In practice
A manufacturer's finance server is encrypted on a Saturday morning along with the file server and the backup server, which sat on the same network with a shared administrator account. The ransom note names the data taken. The company has a second backup: a nightly copy pushed to cloud storage under a separate account whose credentials the network never held, with retention that prevents deletion for thirty days. Restoration takes four days and no payment. The publication threat remains, and the company's legal team, following a plan rehearsed the previous spring, notifies the regulator inside the deadline and its customers the same week. A neighbouring firm hit by the same group, with backups on the same network as its servers, pays.
Same network, shared admin account: backups encrypted with everything else.
Separate account, retention lock: restored in four days, no payment.
Either way: the publication threat and the notification deadline remain.
Phishing is one of the commonest ways ransomware operators get in. It is the door; ransomware is what they do after walking through it, and many phishing attacks end in fraud rather than encryption.
Ransomware is the incident; incident response is the process for handling it. The payment decision, the notifications and the recovery order all belong to the response plan, which is why the plan has to exist before the note does.
A rotating selection from the course directory, drawn from the subcategories where this concept is taught rather than picked for it. Details, price and the provider link are on the course page.
Get certified with Salesforce Data Cloud Consultant certification by practicing actual exam type questions. This Course…
Udemy
FAQ
Should an organisation pay the ransom?
That is a leadership decision, ideally made in principle before an attack and taken with legal advice during one, since payment to some groups is unlawful in some jurisdictions and payment does not guarantee working decryption or deletion of stolen data. The technical goal is to make the question irrelevant by having backups the attacker could not reach.
Will antivirus stop ransomware?
It stops many known payloads and is worth having. It does not stop the intrusion that precedes the payload, which uses legitimate credentials and legitimate tools, and by the time a payload runs the attacker has usually disabled or evaded the protection. Prevention lives in identity, patching and segmentation; recovery lives in backups.
What makes a backup ransomware-proof?
The network cannot write to it, or cannot delete from it. Offline media, storage in a separate account with credentials the production network never holds, or storage with enforced retention that prevents deletion for a fixed period all qualify. A backup server on the same network with a shared administrator account does not, and that is the commonest arrangement.
Sources
The primary text this definition rests on. Read it before you trust ours.
CISA, #StopRansomware Guide (2023)
NIST SP 1800-25, Data Integrity: Identifying and Protecting Assets Against Ransomware and Other Destructive Events (2020)
