Ransomware is malicious software that locks or encrypts a victim's files and demands a ransom payment — usually in cryptocurrency — in exchange for the decryption key. It has become one of the most costly and disruptive threats in cybersecurity, targeting individuals, hospitals, schools, and corporations alike.
How a Ransomware Attack Works
- The attacker delivers ransomware via a phishing email, malicious download, or unpatched vulnerability.
- Once executed, it scans your system for valuable files (documents, photos, databases).
- It encrypts all found files using strong encryption — often AES-256.
- A ransom note appears, typically demanding payment in Bitcoin or Monero within a deadline.
- Paying does not guarantee file recovery — many victims pay and receive no key.
Famous Ransomware Examples
| Ransomware | Year | Impact |
|---|---|---|
| WannaCry | 2017 | 200,000+ systems across 150 countries; NHS hospitals shut down |
| NotPetya | 2017 | $10 billion in damages; wiped systems rather than encrypting |
| REvil | 2019–2021 | Targeted law firms, tech companies; demanded millions per attack |
| LockBit | 2019–present | Largest ransomware group by victim count as of 2024 |
How to Protect Against Ransomware
- Back up regularly — The 3-2-1 rule: 3 copies, 2 different media types, 1 offsite or offline
- Keep all software patched and updated — most ransomware exploits known vulnerabilities
- Never open unexpected email attachments, even from known contacts
- Disable macro execution in Office documents by default
- Segment your network so ransomware cannot spread laterally to all systems
- Use endpoint detection tools that can block suspicious encryption behaviour
People Also Ask
- Should I pay the ransom?
- Law enforcement agencies and security experts advise against paying. It funds criminal operations, does not guarantee recovery, and marks you as a target willing to pay. Your best protection is having backups that make the ransom irrelevant.
- Can ransomware be decrypted without paying?
- Sometimes. Security researchers and law enforcement have released free decryption tools for many ransomware strains. Check nomoreransom.org before considering payment.
Related: Malware | Data breach | Encryption