What Is Ransomware?
Ransomware is malware that encrypts a victim’s data — or locks them out of systems entirely — and demands payment for the key. It has become one of the most damaging categories of attack because it turns any successful intrusion directly into a payday, and because a single infection can halt an entire organization.
How does a modern ransomware attack unfold?#
Today’s attacks are rarely a lone encrypting file. They follow a chain:
- Initial access — through phishing, a stolen credential, or an exposed service.
- Lateral movement — spreading across the network to reach high-value systems.
- Data theft — quietly copying sensitive data out first (for double extortion).
- Detonation — encrypting everything at once, often after backups are found and deleted.
- Extortion — demanding payment for the key, and to not publish the stolen data.
This mirrors the Cyber Kill Chain: ransomware is the actions on objectives stage, so stopping it early in the chain is far cheaper than surviving detonation.
Why are backups the real defense — and not the whole answer?#
Because backups are what let you refuse to pay. If you can restore, encryption loses its leverage. But backups must be tested and offline or immutable — attackers specifically hunt and delete reachable backups first.
| Control | Stops |
|---|---|
| Tested offline/immutable backups | Encryption from forcing payment |
| MFA + patching | The initial access |
| Segmentation + least privilege | Lateral movement |
| Egress monitoring / DLP | The data theft behind double extortion |
Ransomware is the highest-stakes member of the malware family. Continue at the Security Fundamentals hub.
Frequently asked questions#
Should you pay a ransomware demand?
Guidance from agencies like CISA and the FBI is not to pay: payment funds further crime, marks you as a willing target, and offers no guarantee of recovery — some decryptors fail or never arrive. The reliable path back is tested, offline backups. Payment is a business and legal decision made under duress, not a technical fix.
What is double extortion ransomware?
Modern ransomware groups often steal a copy of the data before encrypting it, then threaten to publish it unless paid — even if the victim restores from backup. This "double extortion" means backups alone no longer neutralize the threat; preventing the initial breach and the data theft matters just as much.