ransomware

Ransomware is a type of malicious software designed to deny access to a computer system or data, typically by encrypting files or locking the user out. The attacker then demands payment, usually in cryptocurrency, in exchange for restoring access or providing a decryption key. Some variants also threaten to release stolen data or to publish it publicly if the ransom is not paid, a tactic known as double extortion.

Infection and operation commonly begin with phishing emails, exploit kits, compromised remote access, or supply-chain intrusions. Once inside a network, the malware attempts to propagate, encrypts a large portion of files, and displays a ransom note with payment instructions and deadlines. While early families focused on encryption, many modern strains also exfiltrate data to increase pressure on victims.

Notable examples include WannaCry (2017), which leveraged a Windows vulnerability to rapidly spread across organizations worldwide; NotPetya (2017), which caused extensive damage and was presented as ransomware but functioned primarily as a wiper; and more recent families such as Ryuk, LockBit, Conti, and REvil. The impact can be severe, causing operational downtime, financial loss, regulatory exposure, and harm to critical services, especially in healthcare, government, and manufacturing sectors.

Prevention and defense emphasize good cyber hygiene: regular offline backups, patch management, least-privilege access, multifactor authentication, network segmentation, endpoint detection and response tools, and employee training to recognize phishing. Incident response plans, rapid containment, and forensic analysis are essential for recovery. Law enforcement generally discourages paying ransoms, as payments can encourage ongoing criminal activity and do not guarantee data restoration.