What Is Ransomware and How Does It Work?

Few things are as alarming as opening your computer to find every file renamed and a note demanding money. Ransomware has grown from a niche nuisance into one of the most damaging forms of cybercrime, hitting hospitals, schools, businesses and home users alike. Understanding how it actually works is the first step to making sure it never reaches you.

Stage 1: How ransomware gets in

Almost every attack starts with one of three doors. The most common is a phishing email: a convincing message that tricks you into opening an attachment or clicking a link. The second is a malicious download, often pirated software, a fake update or an infected file. The third is an unpatched vulnerability, a known security hole in software you never updated, which lets the attacker walk in without any action from you.

This is why the most effective defences are also the most boring: be cautious with email, only download from trusted sources, and keep everything updated.

Stage 2: Execution and spread

Once the malicious code runs, it works quietly. Good ransomware does not announce itself immediately. Instead it establishes a foothold, often disables backups and security tools, and spreads to every drive and network share it can reach. On a home PC that might mean your external backup drive. On a business network it can mean hundreds of machines. The delay is deliberate: the more it can reach before you notice, the more leverage the attacker gains.

Stage 3: Encryption locks your files

This is the moment the damage is done. The ransomware encrypts your files using strong cryptography, scrambling them into unreadable data. The key needed to unlock them exists only on the attacker's server. You will often see your file names change or gain a strange new extension, and folders fill with identical ransom-note text files.

Modern encryption is genuinely unbreakable without the key. This is why “just decrypt it” is rarely an option, and why prevention and backups matter so much more than any cure.

Stage 4: The ransom demand

With your files locked, the attacker reveals themselves. A ransom note appears, on screen, as a text file or as your new desktop wallpaper, demanding payment in cryptocurrency, usually with a countdown timer to pressure you. Many modern attacks add a second threat: pay up or we leak your stolen data publicly. This is called double extortion.

Security agencies broadly advise against paying. There is no guarantee you will get a working key, payment funds further crime, and it marks you as a willing target for the future. The only reliable way out is to not need the key at all.

How to protect yourself from ransomware

The reassuring part is that ransomware relies on a chain of steps, and breaking any link stops the whole attack. A handful of habits cover almost every case:

• Keep offline or versioned backups. This is the single most important defence. If your data exists somewhere the ransomware cannot reach, an attack becomes an inconvenience, not a catastrophe. Follow the 3-2-1 rule: three copies, two types of media, one kept offline or off-site.
• Update everything. Operating system, browser, apps. Patches close the holes that attackers use to get in without a click.
• Be sceptical of email. Do not open unexpected attachments or click links in messages you were not expecting, even if they look legitimate. When in doubt, verify through another channel.
• Use reputable security software and keep it on. Modern tools catch many ransomware families before they execute.
• Limit access. Do not run day-to-day as an administrator, and restrict who can reach shared drives. The less a single compromised account can touch, the less an attack can spread.

If you ever are hit, disconnect the device from the network immediately to stop the spread, and do not pay before exploring recovery options. Our ransomware response playbook walks through exactly what to do, and free tools like the No More Ransom project sometimes have a working decryptor for older strains.