Ransomware is malicious software that encrypts files on a computer or network and demands payment, usually in cryptocurrency, for the key. Many gangs now also steal data first and threaten to leak it, a tactic known as double extortion.
How attackers get in
- Phishing emails with malicious attachments or links to fake login pages.
- Stolen or reused passwords for remote access, email or VPN accounts.
- Unpatched software, especially internet-facing devices like VPNs and firewalls.
- Exposed remote desktop services with weak passwords.
Defenses that work
- Keep backups using the 3-2-1 rule: three copies, on two types of storage, with one offline or offsite where ransomware cannot reach it.
- Test restoring from backup, not just making backups.
- Turn on multi-factor authentication, especially for email and remote access.
- Install updates promptly, prioritizing anything exposed to the internet.
- Give people only the access they need, so one compromised account cannot lock everything.
If you are hit
- Disconnect affected devices from the network right away.
- Do not delete anything; evidence helps investigators.
- Report the attack to your national cybersecurity agency or police.
- Restore from clean backups after the entry point is fixed.
Paying the ransom does not guarantee you get your data back, and it funds future attacks. Strong backups are what give you the choice not to pay.
What an attack looks like from the inside
Ransomware rarely strikes the moment someone clicks a bad link. In a typical attack on a business, the criminals first get a foothold on one machine, then spend days or weeks quietly exploring the network. They look for administrator accounts, find where the important data and the backups live, copy files out to use as leverage, and often delete or encrypt the backups they can reach. Only then do they launch the encryption, frequently at night or over a weekend when fewer people are watching.
That delay is good news for defenders. It means there are many chances to spot unusual activity, such as an account logging in at odd hours or large amounts of data leaving the network, before the damage is done.
Ransomware at home
Home users are hit too, usually through pirated software, fake browser updates or malicious email attachments. The defenses are the same, just simpler:
- Keep your operating system and browser set to update automatically.
- Leave the built-in security tools switched on, such as Microsoft Defender on Windows.
- Back up important files to an external drive that you unplug after each backup, plus a cloud service that keeps older versions of files.
- Be wary of any download that claims your browser or video player needs an urgent update.
Cloud sync on its own is not a backup. If your files are encrypted on your computer, a sync service may faithfully copy the encrypted versions. Choose one that keeps a version history so you can roll files back.
A checklist for small businesses
- Turn on multi-factor authentication for email, remote access and any admin accounts.
- Keep at least one backup offline or immutable, meaning it can’t be changed or deleted for a set period.
- Patch internet-facing devices such as VPNs and firewalls within days of a critical update.
- Remove old accounts of people who have left, and don’t let staff work with admin rights day to day.
- Write a one-page incident plan: who to call, how to isolate machines and where the backups are.
- Practice a restore at least once a year, and time how long it takes.
What we think
Ransomware succeeds mostly through basic gaps: missing updates, reused passwords and backups that were never tested. That is good news, because the defenses are well known and mostly cheap.
If you do only two things, turn on multi-factor authentication for email and remote access, and keep at least one backup that ransomware can’t reach. Then actually try restoring from it. A backup you have never tested is a hope, not a plan.