What ransomware is
Ransomware is malicious software that makes your data or devices unusable and then demands payment to restore them. The most common form encrypts files, scrambling them so they cannot be opened without a key held by the attacker. How that scrambling normally protects people is covered in the article on message encryption; ransomware turns the same basic technique against its victim.
A second pattern has become common: the attacker also copies data before locking it and threatens to publish it. This means that restoring files from a backup solves the lock-out problem but not the data exposure problem. Not every incident includes both, and details vary.
The demand is often made in digital money, because it is relatively hard to reverse. That is a feature of the criminal business model, not a reason to be suspicious of digital payments in general.
How it gets in
Ransomware needs some way onto a system. Without giving a recipe, the broad categories are well known to defenders.
- Deceptive messages. An email or text persuades someone to open an attachment or click a link. This is the classic route, and it is why the psychology of phishing scams is so relevant.
- Unpatched software. Known flaws in operating systems, applications or network equipment can be used to get in without any user action. Attackers tend to move quickly once a flaw is public, which is why software updates matter.
- Stolen or weak credentials. Reused passwords, or logins exposed in earlier breaches, can allow someone to sign in to remote access services as if they were a legitimate user.
- Exposed services. Systems left reachable from the internet with weak protection, such as poorly secured remote access, are a frequent entry point for organizations.
- Infected downloads. Pirated software or files from untrustworthy sources sometimes carry hidden malware.
Why it spreads
Once inside one computer, ransomware can often reach others. Shared drives, network folders and cloud storage that syncs automatically can all carry the damage beyond the first device. In organizations, an attacker who gets in may spend some time exploring, collecting more powerful credentials and finding backups before triggering the lock, so that the effect is as large as possible.
Several factors increase the spread:
- Everyone having more access than their job requires, so one compromised account reaches a lot.
- Backups connected to the same network and therefore reachable and also encrypted.
- Old, unupdated systems that cannot be easily replaced, particularly in places like hospitals or small businesses with limited budgets.
- Reliance on a single, shared supplier or service, so a weakness there affects many customers at once.
Connected devices in homes and workplaces can also be weak links, a topic touched on in the discussion of the internet of things.
Why it hurts so much
For individuals, the loss may be family photos, documents or a work laptop. For organizations, ransomware can halt operations, delay services and cause long recovery periods. The pressure of a deadline and the stakes involved are part of the design: the attacker wants a decision made fast.
Defensive principles
Defense is mostly about limiting both the likelihood and the damage, using the layered approach described in the cyber safety basics guide.
Keep good backups. This is the most important single protection. Keep multiple copies, with at least one that is offline or otherwise isolated from your main device, so that malware cannot reach it. Test that you can restore from it. Remember that a copy that is continuously synced with your files may simply sync the damage.
Update software. Installing updates promptly closes many known entry points. Enable automatic updates where practical, and retire software that no longer receives fixes.
Protect accounts. Use unique passwords, ideally through password managers, and turn on two-factor authentication, particularly for email and remote access.
Be cautious with messages and downloads. Verify unexpected attachments and links through another route, and avoid software from unofficial sources.
Limit access. Use standard rather than administrator accounts for daily tasks, and share files only with those who need them. For organizations, separating networks and limiting permissions can stop an incident from spreading.
Use reputable security software and keep it current, understanding that it reduces risk rather than eliminating it.
If it happens
Authorities and security agencies commonly advise disconnecting the affected device from the network to limit spread, and avoiding hasty decisions. Contact your IT support, a qualified professional or the relevant authorities. Many official bodies publish guidance and, in some cases, may have tools or advice for particular strains.
Whether to pay is a difficult question, and official advice is generally to be cautious about it. Payment does not guarantee that data will be restored or that stolen copies will be deleted, and it may encourage further attacks. Outcomes are uncertain either way, which is why preparation, especially backups, is worth far more than any decision made in the middle of a crisis.