What is Ransomware?
Ransomware is malware that encrypts a victim's files or threatens to publish stolen data, then demands payment in exchange for a decryption key or silence. It targets individuals, businesses, and critical infrastructure, and can spread across a network within minutes of initial execution.
What it is
Ransomware is a class of malicious software with two main variants. Crypto-ransomware encrypts files on local drives and network shares, making them unreadable without a decryption key. Double-extortion ransomware also exfiltrates data before encrypting it, so attackers can threaten to publish sensitive information even if the victim restores from backups.
A typical attack follows a pattern:
- Initial access via phishing email, exposed remote desktop, or a software vulnerability.
- Lateral movement to reach high-value systems and backups.
- Privilege escalation to gain administrator rights.
- Encryption or exfiltration of files.
- Ransom note delivery demanding payment, usually in cryptocurrency.
The time between initial access and full encryption can be minutes or hours, depending on the ransomware family.
Why it matters
Ransomware causes direct financial loss through ransom payments, recovery costs, and downtime. It also causes regulatory exposure when personal or health data is exfiltrated. Attacks on hospitals, utilities, and manufacturers have disrupted critical services for days or weeks. Even organizations that refuse to pay face expensive forensic investigations and system rebuilds.
How tools address it
Endpoint Detection and Response (EDR) platforms are the primary technical control. They monitor file system activity, process behavior, and memory execution in real time. When a process begins encrypting files at high speed, an EDR agent can terminate it and quarantine the host. Some agents limit damage to a small number of files before containment kicks in.
Endpoint Protection Platforms (EPP) add signature-based and heuristic detection to block known ransomware binaries before they execute. File Integrity Monitoring (FIM) tools detect unauthorized changes to critical files and directories. Workload protection tools extend similar controls to cloud and server workloads.