Ransomware

Ransomware is malicious software that encrypts victim data and demands payment for the decryption key, often with threats to publicly release stolen data.

Ransomware is a type of malware that encrypts victim files and demands ransom payment for the decryption key. Modern ransomware also exfiltrates data for double extortion.

Attack lifecycle: 1. Initial Access: Phishing, RDP vulnerability, supply chain 2. Persistence: Establish backdoors, create accounts 3. Discovery: Map network, identify valuable targets 4. Lateral Movement: Spread to other systems 5. Exfiltration: Steal data before encryption 6. Encryption: Deploy ransomware, encrypt files 7. Extortion: Demand payment, threaten data release

Defense strategies: - Immutable, offline backups (3-2-1 rule) - EDR/XDR with ransomware-specific detection - Network segmentation to limit spread - Privileged access management - Email filtering and user training - Patch management for known CVEs

Paying ransom is controversial—funds criminal groups and doesn't guarantee recovery.

Why It Matters

Ransomware is the most financially devastating cyber threat, with average total costs exceeding $4.5 million per incident including downtime, recovery, and reputational damage. Modern double-extortion ransomware not only encrypts data but also exfiltrates it, threatening public release even if you restore from backups. Immutable, tested backups combined with EDR, network segmentation, and employee training provide the most effective defense against this evolving threat.

Key Points

Double extortion now standard (encrypt + data leak threat)

Immutable backups are the most important defense

Average downtime is 21 days after attack

Ransom payments don't guarantee data recovery

Prevention is more cost-effective than recovery

Applicable Compliance Frameworks

SOC 2 ISO 27001 HIPAA NIST CSF

Related Terms

Backup Strategy

A backup strategy defines how an organization protects data through regular copies, including what to back up, how often, where to store backups, and how to verify they can be restored.

Incident Response

Incident response is a structured approach to preparing for, detecting, containing, and recovering from security incidents while minimizing damage.

Malware Protection

Malware protection encompasses technologies and practices to prevent, detect, and remove malicious software including viruses, ransomware, spyware, and trojans.