What is ransomware and how does an attack actually unfold?
Ransomware locks your files or systems until you pay criminals to restore access. Here is exactly how that happens, step by step.
Ransomware is malicious software that encrypts, or scrambles, a victim's files and demands payment, usually in cryptocurrency, in exchange for the decryption key needed to unscramble them. Attacks follow a repeatable playbook that typically runs for days or weeks before the victim sees any ransom note. Understanding each stage is the fastest way to spot where defences can interrupt it.
What kind of criminals run ransomware attacks?
Ransomware is almost always operated by organised criminal groups, not lone hackers. Many run as "ransomware-as-a-service" businesses, meaning a core developer rents the malware to affiliate attackers who split the ransom proceeds.
Groups such as LockBit, ALPHV (also called BlackCat) and Cl0p have published victim lists, named ransom demands in the millions of dollars and targeted hospitals, schools, manufacturers and local governments. CISA has catalogued LockBit as the most deployed ransomware variant globally, with victims in critical infrastructure across dozens of countries. These groups operate support desks, publish press releases and, in some cases, run formal affiliate recruitment programmes.
How does ransomware first get into a network?
The single most common entry point is a phishing email carrying a malicious attachment or link. A worker opens what looks like an invoice, the attachment runs hidden code, and the attacker has a foothold inside the network.
Other frequent routes include exploiting unpatched software vulnerabilities and brute-forcing remote-desktop protocol (RDP), a service that lets employees log into work computers from home. CISA lists internet-facing RDP as a primary ransomware entry vector. Stolen credentials bought on criminal marketplaces are increasingly common too, letting attackers simply log in rather than break in.
What happens between entry and the ransom note?
This quiet period, called dwell time, can last days to months. Attackers move laterally, meaning they hop from the first infected machine to others across the network, hunting for administrator accounts that give them wider control.
During this phase they typically:
- Disable security tools and backup systems so recovery is harder.
- Steal a copy of sensitive data before encrypting anything, a tactic called double extortion.
- Map which servers hold the most critical files.
Only once they control enough of the network do they deploy the encryption payload. That timing is deliberate: encrypting everything at once maximises damage and ransom leverage.
What does encryption actually do to the files?
Encryption converts readable files into unreadable ciphertext using a mathematical key. Without the matching decryption key, the data is effectively gone. NIST describes encryption as a process that renders data unintelligible to anyone lacking the correct cryptographic key.
Modern ransomware typically uses strong, industry-standard encryption algorithms, meaning there is no practical way to crack the scrambling by brute force. Victims who refuse to pay and have no clean backups often lose their data permanently.
What is double extortion and why does it matter?
Double extortion means attackers both encrypt the victim's files and threaten to publish stolen data publicly if the ransom is not paid. This changes the calculation for victims who might otherwise restore from backups and ignore the demand.
The Cl0p group used exactly this tactic against hundreds of organisations in a 2023 campaign exploiting a vulnerability in the MOVEit file-transfer software, tracked by NIST as CVE-2023-34362. Ransom demands in that campaign reached into the tens of millions of dollars across victims in finance, healthcare and government sectors. Several organisations refused to pay; Cl0p published their data.
How do attackers collect the ransom?
Payment is demanded in cryptocurrency, almost always Bitcoin or Monero, because transactions are difficult to reverse and can be structured to obscure the recipient. Attackers provide a unique wallet address and often a deadline, after which they threaten to raise the price or publish stolen data.
The U.S. Treasury's Office of Foreign Assets Control warns that paying ransoms to sanctioned groups may itself violate U.S. law, adding a legal risk on top of the financial one. Some victims pay and never receive a working decryption key.
The stages of a typical ransomware attack at a glance
| Stage | What attackers do | Defender's window |
|---|---|---|
| Initial access | Phishing, RDP exploit, stolen credentials | Email filtering, MFA, patching |
| Persistence | Install backdoors, create rogue accounts | Endpoint detection alerts |
| Lateral movement | Spread across internal network | Network segmentation |
| Data theft | Exfiltrate sensitive files | Data-loss prevention tools |
| Encryption | Lock files across servers | Offline backups, immutable storage |
| Extortion | Demand payment, threaten publication | Incident response plan |
Should victims pay the ransom?
Law enforcement agencies including the FBI formally advise against paying ransoms because payment funds future attacks and does not guarantee data recovery. Many victims who paid received a slow or broken decryption tool.
That said, some organisations, particularly hospitals facing life-safety risks, have paid to restore systems quickly. Each case involves legal, ethical and operational judgements that go beyond a simple yes-or-no answer.
Common questions
Can ransomware spread to other computers on the same network?
Yes. Once inside a network, ransomware commonly uses built-in Windows administration tools to move between machines, which is why a single infected laptop can lead to an organisation-wide outage within hours.
Is it possible to recover files without paying?
Sometimes. Clean, offline backups are the most reliable recovery method. Free decryption keys for some older ransomware strains are also available through the No More Ransom project, a public-private initiative supported by Europol.
What sectors get hit most often?
Healthcare, education, government and financial services appear most frequently in attack disclosures, largely because they hold sensitive data, operate critical services and historically ran older, less-patched systems.
