Ransomware is malware that encrypts your files and demands payment for the key. Attacks start with malicious email, unpatched software or exposed remote access. Once inside the malware spreads and then locks files across devices and network shares. Offline backups, updates and careful email habits reduce the damage. Authorities do not encourage paying the ransom.
Picture opening your computer to find your files locked and a note that demands money. That is ransomware. This guide explains how an attack works and how to protect your files.
What is Ransomware?
CISA describes ransomware as malware that encrypts files on a device so the files and the systems that depend on them become unusable. Attackers then demand a ransom for decryption.
CISA notes that incidents are increasingly prevalent among government and critical infrastructure organizations. Home users and small businesses also face the same malware.
How does Ransomware Get Onto a Computer?
Several routes lead into a device or network according to the UK National Cyber Security Centre (NCSC).
- Malicious email. Attachments and links in malicious emails deliver malware. Mail filtering can block malicious emails and remove executable attachments.
- Malicious websites. Blocking known malicious websites cuts this route.
- Exposed remote access. Attackers use exposed services like Remote Desktop Protocol and unpatched remote access devices.
- Software vulnerabilities. Attackers exploit flaws in devices to force their code to execute.
- Macros and scripts. Office macros and scripting tools can launch malware.
What does Ransomware Do After It Gets in?
NCSC explains that attackers first get into the network, set up control and install encryption software. Next the malware activates. It locks devices and encrypts data across the network. Finally a ransom demand appears on screen and asks for cryptocurrency through an anonymous web page. See NCSC ransomware overview.
Some attackers also copy your data first. CISA says ransomware actors threaten to sell or leak the stolen data if you do not pay. People call this double extortion.
Compare the four stages and where you can stop every stage in the table.
| Stage | What Happens | Where You Can Stop It |
|---|---|---|
| Entry | Attackers get in through malicious email, exposed remote access or unpatched software | Mail filtering, patching and limited remote access |
| Foothold | Attackers set up control and install encryption software | Least privilege and tight permissions |
| Encryption | Malware locks devices and encrypts data across the network | Offline backups you can restore |
| Demand | A ransom note appears and attackers may threaten to leak copied data | Isolate devices and avoid paying before you explore recovery |
Should You Pay the Ransom?
No. NCSC and UK law enforcement do not encourage, endorse or condone payment. NCSC lists four reasons. Paying does not guarantee you regain access. Your device remains infected. You fund criminal groups. Attackers can attack you again.
Microsoft agrees that paying the ransom does not guarantee restored access to your data. Tested backups are the reliable way out.
How do You Protect Yourself From Ransomware?
Layered habits work better than any single tool. Start with five.
- Maintain offline backups. CISA recommends offline, encrypted backups that you test regularly. Microsoft states that attackers frequently attack backups and recovery documents and that the strongest protection stores backups in immutable storage or fully offline or off site. See Microsoft ransomware recovery plan.
- Patch and update software. CISA recommends patching operating systems and software and prioritizing systems that face the internet.
- Use multifactor authentication. CISA recommends phishing resistant multifactor authentication for email, VPNs and critical systems.
- Limit remote access and permissions. CISA recommends limiting exposed remote services and applying least privilege.
- Filter email and disable macros. NCSC recommends mail filtering and CISA recommends disabling macros in email attachments.
Cloud sync does not replace a backup because sync mirrors changes. See what cloud storage is for the difference. OneDrive adds a safety net. Microsoft 365 notifies you when it detects an attack on your OneDrive files and guides you through recovery. See Microsoft OneDrive ransomware recovery guidance.
What should You Do if Ransomware Hits?
Act fast and follow the order below. CISA lists isolation as the first response step. See CISA StopRansomware Guide.
- Isolate the affected devices. CISA says to isolate affected systems immediately. Take the network offline at the switch if several systems are affected. Otherwise unplug devices or disconnect them from the wireless network. Power them down only if you cannot disconnect them.
- Use another channel to communicate. CISA advises phone calls so attackers do not learn that you detected them.
- Report the incident. CISA lists CISA, the FBI and the Secret Service in the United States. UK organizations report through gov.uk.
- Check for a free decryptor. No More Ransom is a project by police, Europol and security companies that lists decryption tools for some strains.
- Clean the devices and restore from a clean backup. OneDrive users follow Microsoft steps to confirm infection, clean every device and restore OneDrive.
IT teams can follow the full response process in the ransomware playbook for IT professionals.
Frequently Asked Questions
What does Ransomware Do to My Files?
Ransomware encrypts your files so you cannot open them without the key. CISA describes it as malware that encrypts files on a device so the files and dependent systems become unusable.
How does Ransomware Get Onto a Computer?
NCSC describes malicious email, malicious websites, exposed remote access like Remote Desktop Protocol, device vulnerabilities and malicious macros or scripts as common routes.
Should I Pay the Ransom to Get My Files Back?
No. NCSC and UK law enforcement do not encourage payment. Paying does not guarantee access. Your device remains infected. Payment funds criminal groups and attackers can attack you again.
Can Antivirus Software Stop Ransomware?
Antivirus is one layer and you need more. NCSC lists antivirus among several defences that also include backups, mail filtering, patching and staff awareness training.
Will Backups Protect Me From Ransomware?
Yes when attackers cannot reach the backup. CISA recommends offline, encrypted backups that you test regularly. Microsoft warns that attackers frequently attack backups.
What is Double Extortion?
Double extortion adds a second threat to the encryption. CISA says ransomware actors threaten to sell or leak stolen data if you do not pay.
What should You Do the Moment You Notice an Infection?
Isolate the affected device from the network right away. CISA says to isolate affected systems immediately and to power a device down only when you cannot disconnect it.
Key Takeaways
- Ransomware encrypts your files and demands payment for the key.
- Malicious email, malicious websites, exposed remote access and unpatched software are the common routes in.
- Some attackers copy your data first and threaten to leak it, which people call double extortion.
- Offline, tested backups are the strongest defence because attackers frequently attack online backups.
- Authorities do not encourage payment because it does not guarantee you regain access.
Sources and References
This explainer draws on official guidance from CISA, the UK National Cyber Security Centre and Microsoft.
- Ransomware 101 (CISA) www.cisa.gov
- #StopRansomware Guide (CISA) www.cisa.gov
- What You Need to Know About Ransomware (NCSC) www.ncsc.gov.uk
- Mitigating Malware and Ransomware Attacks (NCSC) www.ncsc.gov.uk
- Prepare for Ransomware Attacks With a Backup and Recovery Plan (Microsoft Learn) learn.microsoft.com
- How to Detect Ransomware and Recover Files Using OneDrive (Microsoft Support) support.microsoft.com