The short answer
Quick answer: Ransomware is malicious software that encrypts an organisation's files so they cannot be used, then demands payment for the key. Attackers usually get in through a phishing email, stolen or weak login details for remote access, or an unpatched internet-facing system. Modern attacks are rarely instant: intruders spend days or weeks inside the network, gaining wider access, copying sensitive data, and disabling backups, before triggering encryption everywhere at once. The defences that matter most are offline, tested backups, multi-factor authentication, prompt patching, limited privileges and network segmentation.
This article explains how attacks work at a conceptual level, so that defenders know what they are protecting against.
Why it works: borrowed cryptography
Ransomware uses the same strong, standard encryption that protects online banking. That is exactly why it is effective: correctly encrypted data cannot be recovered without the key.
The general scheme is hybrid encryption, the idea described in how public key cryptography works:
- Files are encrypted quickly with symmetric keys.
- Those keys are then locked with a public key belonging to the attacker.
- Only the attacker's private key, which never touches the victim's systems, can unlock them.
So there is generally no technical shortcut once files are encrypted. Free decryption tools exist for some older or flawed strains, but they are the exception. This is why the outcome of an attack is decided mostly by what was done beforehand.
How an attack unfolds
1. Getting in
National cyber security agencies consistently report the same main entry routes:
| Route | What happens |
|---|---|
| Phishing | An email persuades someone to open an attachment, follow a link or enter their password on a fake page. See how email works for how sender checks help |
| Stolen or weak credentials | Passwords reused from earlier breaches or guessed, used against remote desktop, VPN or cloud logins that lack a second factor |
| Unpatched systems | A known vulnerability in an internet-facing device or application that has not been updated |
| Third parties | Access through a supplier, a managed service provider or compromised software |
2. Settling in
Once inside, attackers do not act immediately. Over hours to weeks they typically:
- Establish persistence, so they can return.
- Raise their privileges, aiming for administrator control of the whole environment.
- Explore, mapping servers, file shares and backups.
- Move laterally, from the first machine to many.
They often use the organisation's own legitimate administration tools, which makes the activity harder to tell apart from normal work.
3. Stealing data
Before encrypting, most groups now copy sensitive data out. This enables double extortion: even if the victim can restore from backups, the attackers threaten to publish the stolen material.
4. Removing the safety net
Attackers look for backups and try to delete or encrypt them, and they try to switch off security software. Backups that are reachable from the network with the same administrator account are often lost at this stage.
5. Encryption and the demand
Encryption is launched across as many systems as possible at once, frequently at night or over a weekend. Files become unreadable and a note explains how to make contact and pay, usually in cryptocurrency.
The gap between entry and encryption is important. It is a window in which the intrusion can be detected and stopped.
The business behind it
Ransomware is organised crime with a division of labour, often called ransomware as a service:
- Developers build and maintain the software and the payment infrastructure.
- Affiliates carry out the intrusions and share the proceeds.
- Initial access brokers sell footholds in already-compromised networks.
This model lowers the skill needed to run an attack, which is one reason the problem is so widespread. Hospitals, local authorities, schools and businesses of every size have been hit.
Defences that make the difference
Guidance from agencies such as CISA and the UK's NCSC converges on a short list.
Backups you can actually restore
- Follow the 3-2-1 rule: three copies of your data, on two different types of storage, with one copy off-site.
- Keep at least one copy offline or immutable, so that nothing on the network, including an administrator account, can alter or delete it.
- Test restores regularly. An untested backup is a hope, not a plan. Know how long a full recovery takes.
- Protect the backup system with separate credentials.
Multi-factor authentication
Require a second factor on everything exposed to the internet: email, VPN, remote access, cloud consoles, and all administrator accounts. This single measure blocks most attacks that rely on stolen passwords. See how two-factor authentication works.
Patch promptly
Prioritise internet-facing systems and vulnerabilities known to be exploited. Remove or isolate systems that can no longer be updated.
Least privilege
- Users should not be administrators on their own machines.
- Administrators should use separate accounts for administrative work.
- Service accounts should have only the access they need.
The less an initial foothold can reach, the less an attacker can do with it.
Segment the network
If every machine can talk to every other, one infected laptop endangers everything. Dividing the network and restricting traffic between segments contains an intrusion.
Reduce the attack surface
Do not expose remote desktop or administrative interfaces directly to the internet. Disable services you do not use.
Detect and respond
- Use endpoint detection and response software.
- Collect logs centrally and watch for the warning signs: unusual logins, new administrator accounts, security tools being disabled, large outbound transfers.
- Because attackers linger before encrypting, early detection can stop an attack before the damage is done.
Filter email and train people
Use email authentication and filtering, block risky attachment types, and train staff to report suspicious messages. Reporting must be easy and blame-free.
Have a plan
Write an incident response plan, keep a copy that is available when systems are down, know who to call, and rehearse it.
If it happens
- Isolate affected systems from the network to stop the spread. Do not simply wipe them, since evidence may be needed.
- Activate your incident plan and bring in experienced responders.
- Report it to the relevant national authority and law enforcement, and meet any legal duties to notify regulators or affected people.
- Work out what happened: how they got in, what was taken.
- Check for a free decryptor from reputable security organisations.
- Restore from clean backups only after the attacker's access has been removed. Otherwise they will simply return.
- Reset credentials across the environment.
Should you pay?
Authorities generally advise against paying. Payment does not guarantee that you will get working keys, does not guarantee that stolen data is deleted, funds further attacks, and may be unlawful in some circumstances. Organisations facing this decision should take legal and specialist advice.
For individuals
- Keep your operating system and applications updated.
- Back up important files to an external drive that you disconnect afterwards, or to a cloud service with version history.
- Be cautious with unexpected attachments and links.
- Use unique passwords with a password manager, and turn on two-factor authentication. See how passwords should be stored for why reuse is so dangerous.
Frequently asked questions
How does ransomware usually get in?
Through phishing emails, stolen or weak passwords on remote access services, or unpatched internet-facing software.
Can files be recovered without paying?
Yes, from clean backups. Occasionally a free decryption tool exists for a particular strain. Otherwise, properly encrypted files cannot be recovered without the key.
What is double extortion?
Attackers steal data before encrypting it, then threaten to publish it if they are not paid, so that backups alone do not remove the pressure.
Do backups fully protect against ransomware?
They protect against the loss of data and allow recovery, provided they are offline or immutable and tested. They do not prevent the theft and publication of data.
Conclusion
Ransomware succeeds less through technical brilliance than through ordinary gaps: a reused password, a missing patch, backups reachable from the network. The encryption cannot be undone afterwards, so resilience is built in advance. Offline backups, multi-factor authentication, patching, least privilege and segmentation, together with watchful monitoring, turn a potential catastrophe into a recoverable incident.
Related articles
- How Public Key Cryptography Works
- How Two-Factor Authentication Codes Are Generated
- How Passwords Should Be Stored (Hashing and Salting)
- How Email Travels From Your Outbox to Someone's Inbox
Sources and further reading
