Ransomware is malware that encrypts your files or locks you out of your system, then demands payment which is almost always in cryptocurrency to restore access. Unlike malware that wants to stay hidden, ransomware announces itself: the attack only works if the victim knows they’ve been hit.
That part is the key to understanding it. Most malware succeeds by remaining undetected. Ransomware succeeds by being impossible to ignore.
How a Ransomware Attack Works
- Initial access – Attackers get in through phishing, exposed RDP, stolen VPN credentials, or an unpatched vulnerability.
- Establish foothold – Malware installs, establishes persistence, and calls out to a command-and-control server.
- Reconnaissance and spread – Attackers move laterally, mapping the network to find file servers, backups, and domain controllers. This dwell time can last days or weeks.
- Sabotage recovery – Backups, shadow copies, and restore points get deleted or encrypted first. This is the step that turns an incident into a crisis.
- Exfiltrate (modern attacks) – Sensitive data is stolen before encryption, to enable a second extortion lever.
- Encrypt and demand – Files are encrypted, a ransom note appears, and a countdown begins.
Common Types of Ransomware
- Crypto-ransomware – Encrypts files while leaving the system usable. The most common form. Example: WannaCry.
- Locker ransomware – Locks the device or interface entirely; files aren’t encrypted but access is blocked.
- Double-extortion – Steals data and encrypts it, then threatens to publish if you don’t pay. Now the dominant model, because it defeats “we’ll just restore from backup.” Example: Maze, LockBit.
- Ransomware-as-a-Service (RaaS) – Not a type of payload but a business model: developers lease the ransomware to affiliates for a cut. It’s why attack volume exploded – deploying it no longer requires building it. Example: DarkSide, LockBit.
Ransomware vs. Wiper vs. Scareware (the distinction that trips people up)
These three all look like a ransom demand on screen. Only one of them is actually offering your data back:
| Trait | Ransomware | Wiper | Scareware |
|---|---|---|---|
| Data actually recoverable? | ✓ Yes – attacker holds a real key | ✗ No – destruction is the goal | ✓ Yes – nothing was encrypted |
| Attacker’s real motive | Money | Sabotage / destruction | Money, via bluff |
| Is the ransom demand genuine? | ✓ Yes | ✗ No – it’s a cover story | ✗ No – pure deception |
| Paying helps? | Sometimes (no guarantee) | Never – key doesn’t exist | Never – nothing to unlock |
Bottom line: If your files are encrypted and a real key exists → ransomware. If the “ransom note” is camouflage for destruction with no recovery possible → wiper. If it’s a scary pop-up demanding money but nothing was actually encrypted → scareware.
Real-World Examples
- WannaCry (2017) – Spread via the EternalBlue SMB exploit, giving it worm-like self-propagation. Notable because it required no phishing click to spread between machines and it hit hundreds of thousands of systems across 150+ countries, including the UK’s NHS.
- NotPetya (2017) – Presented itself as ransomware, but was a wiper: the encryption was irreversible by design and the payment channel was non-functional. It’s the textbook illustration of why the table above matters.
- Colonial Pipeline (2021) – DarkSide RaaS affiliates got in through a single compromised VPN credential with no MFA, and the operational shutdown disrupted fuel supply across the US East Coast. The exploit wasn’t sophisticated, it was one unprotected account.
Indicators You May Have Ransomware
- Mass file renaming or unfamiliar file extensions appearing across shares
- Ransom note files (
README.txt,HOW_TO_DECRYPT.html) dropped into directories - Shadow copy deletion (
vssadmin delete shadows) – a hallmark precursor - Spike in file-modification events in a short window
- Backup jobs failing or backup servers unreachable
- Security tools disabled; unusual outbound traffic to unknown hosts
- Off-hours logins or lateral movement between systems
How to Detect and Mitigate Ransomware
- Backups on the 3-2-1 rule – 3 copies, 2 media types, 1 offline/immutable. Attackers delete backups first, so a backup reachable from the network is a backup they’ll encrypt too. Test restores – an untested backup is a hypothesis.
- MFA everywhere, especially VPN/RDP – Colonial Pipeline’s entire incident traces to one credential without it.
- Patch aggressively – WannaCry spread on a vulnerability with a patch already available.
- Network segmentation – Limits how far the attack travels once inside.
- Least privilege – Contains what a compromised account can encrypt.
- EDR + monitoring – Catches the recon and shadow-copy deletion during the dwell time, before the encryption stage.
- User training – Phishing is still the #1 front door.
- Tested incident response plan – Decide who does what before the countdown starts.
Frequently Asked Questions
Should you pay the ransom? Law enforcement generally advises against it. Paying doesn’t guarantee a working decryption key, doesn’t stop stolen data from being leaked, marks you as a paying target for repeat attacks, and funds further criminal operations. In some jurisdictions, paying certain sanctioned groups may itself carry legal exposure.
Is ransomware a virus? No. A virus self-replicates by attaching to host files. Ransomware is defined by what it does – encrypt and extort – not by how it spreads. It’s usually delivered by a Trojan or an exploit.
What’s the difference between ransomware and a Trojan? They’re different categories, not competitors. A Trojan is a delivery method (malware in disguise); ransomware is a payload (the extortion itself). A Trojan very often delivers ransomware.
Can backups fully protect you from ransomware? Not by themselves anymore. Backups defeat encryption, but double-extortion attacks steal your data first – so restoring cleanly doesn’t stop the threat to publish it. Backups plus data protection plus prevention.
How does ransomware get in? Most commonly phishing, exposed or weakly-protected RDP, stolen VPN credentials, and unpatched internet-facing vulnerabilities.
Five scenario questions in the style of the Security+ exam.
Key Takeaway
Ransomware encrypts data or locks systems to extort payment, and modern attacks add data theft so that backups alone no longer end the threat. It’s a business – RaaS made it scalable, and most breaches start with something unglamorous: a phished user, an exposed RDP port, an account without MFA. Defense is layered: offline immutable backups, MFA, patching, segmentation, monitoring, and a rehearsed response plan.
Security+ Exam Focus
- Exam: CompTIA Security+ (SY0-701)
- Domain: 2.0 – Threats, Vulnerabilities, and Mitigations
- Objective: 2.4 – Given a scenario, analyze indicators of malicious activity
- What they test: Recognizing ransomware indicators (shadow copy deletion, mass encryption, ransom notes), distinguishing it from wipers and scareware, and selecting the right mitigation – backups, MFA, segmentation.
Related Notes
- What Is a Trojan? – the most common delivery method for ransomware
- What Is Phishing? – the #1 initial access vector
- Zero-Day Vulnerabilities – how unpatched flaws let it in
- What Is a File-Based Threat?
- Removable Device Threats
Additional Resources
For the full Security+ note set, visit our main Sec+ page. For walkthroughs, see our YouTube channel.