What Ransomware Actually Does
Ransomware is malware that encrypts your files and demands a payment — usually in cryptocurrency — for the decryption key. Modern variants (called double-extortion) also steal a copy of your data first and threaten to publish it if you refuse to pay.
The economics are brutal. The global cost of ransomware crossed $30 billion in 2024, and the average downtime per incident is roughly three weeks.
Anatomy of a Typical Attack
- Initial access. Usually a phishing email, an exposed RDP server, or an unpatched VPN appliance.
- Reconnaissance. The attacker quietly explores the network, looking for backup servers, file shares, and domain controllers.
- Credential theft. Tools like Mimikatz harvest cached credentials and Active Directory hashes.
- Lateral movement. Using stolen credentials, the attacker spreads to as many systems as possible.
- Data exfiltration. Sensitive files are copied off the network for the extortion threat.
- Detonation. Ransomware is launched on all reachable systems simultaneously — often at 3 AM on a Saturday.
- Ransom note. A note appears with the demand and a link to a Tor-hosted negotiation portal.
The whole sequence can take anywhere from a few hours to several months.
Why People Pay (and Why You Shouldn't)
Paying the ransom is tempting for three reasons:
- Downtime is costing more than the demand.
- Backups have been encrypted or destroyed.
- The stolen data would cause regulatory or reputational damage if released.
But paying has serious downsides:
- No guarantee of recovery. Decryption tools often work poorly, miss files, or are buggy.
- You become a repeat target. Paying signals that you will pay again.
- You are funding the next attack — on someone else.
How to Avoid It
1. Backups
A 3-2-1 backup strategy is the single biggest determinant of survival:
- 3 copies of important data
- on 2 different media
- with 1 copy offline or air-gapped
Cloud backups that are continuously writable from the source machine will be encrypted alongside everything else. You need at least one copy the ransomware cannot reach.
2. Patch Aggressively
Patch internet-facing systems within 48 hours of a critical CVE. Most ransomware groups weaponise public exploits within days.
3. Multi-Factor Authentication
Enable MFA on every remote access path: VPN, RDP, email, cloud admin consoles. This single change eliminates the majority of credential-based intrusions.
4. Lock Down RDP
Never expose RDP directly to the internet. Place it behind a VPN, restrict it to specific IPs, or use a zero-trust access proxy.
5. Endpoint Protection
A modern EDR product can detect the suspicious behaviours of ransomware (mass file encryption, shadow copy deletion) and halt them in seconds.
6. Train Your People
Phishing is still the number-one initial vector. Regular simulated phishing tests and clear reporting channels for suspicious emails materially reduce risk.
If You Get Hit
- Isolate. Disconnect affected machines from the network immediately.
- Do not power off the systems — memory forensics may help recovery.
- Contact incident response professionals before doing anything else.
- Notify law enforcement — many jurisdictions require it; in some, it is required to claim cyber insurance.
- Restore from clean backups once the entry vector is closed.
Conclusion
Ransomware is not magic — it is the result of well-known and largely preventable security failures. The hard part is doing the basics consistently. Patching, MFA, offline backups, and email vigilance will protect against the overwhelming majority of attacks.