What is ransomware?

Ransomware is malware that blocks access to a device or its files, usually by encrypting them, and demands payment to restore access. It is one of the most damaging categories of malware because it targets something organizations can least afford to lose: the ability to read their own data. Threat actors have added pressure over the years by threatening to leak stolen data, even when backups make the encryption recoverable. This page covers how ransomware attacks unfold, the main categories in circulation, how organizations detect and respond to them, and how to reduce the risk of a successful attack.

Key takeaways

Ransomware encrypts or locks data and demands payment, usually in cryptocurrency, for a decryption key or restored access.
Double and triple extortion are now common tactics. Threat actors steal data before encrypting it, then threaten to leak it even if the affected organization can restore from backup.
Phishing, exploited vulnerabilities, and compromised remote access credentials account for most successful ransomware intrusions.
Ransomware-as-a-service (RaaS) lets affiliates rent ready-made ransomware and infrastructure, widening the pool of threat actors who can run a campaign.
Backups reduce the impact of encryption but don't stop a leak threat. Detecting the intrusion before encryption starts matters as much as recovery planning.

How does a ransomware attack work?

A ransomware attack rarely starts with encryption. Threat actors often research a target first, looking for exposed remote access services, unpatched systems, or employees likely to fall for a phishing attempt. The initial foothold usually comes through one of those same channels: a phishing email, a compromised remote access credential, or an exploited vulnerability. From there, the threat actor spends time inside the network before deploying the ransomware.

Once inside, threat actors typically expand their access and identify what they have compromised. They move from one system to another and gather credentials with higher privileges. Many modern ransomware operations then locate and exfiltrate valuable data, such as customer records, financial information, or intellectual property, before encryption begins. That stolen data becomes the pressure point for a second demand.

Only then does the ransomware encrypt files across the systems the threat actor can reach, often after disabling backups or system restore features. A ransom note appears, usually demanding payment in cryptocurrency by a set deadline. It may also threaten to publish the stolen data if the deadline passes without payment.

A brief history of ransomware

Ransomware isn't a recent invention. The earliest documented case, known as the AIDS Trojan, was distributed on floppy disks in 1989 and demanded payment by mail to unhide file directories on the affected computer. Because it hid file names rather than encrypting the underlying data, it was straightforward to reverse without paying.

The modern era began in 2013 with CryptoLocker, one of the first widely distributed families to use strong encryption and demand payment in Bitcoin. This gave threat actors a fast and comparatively difficult-to-trace way to collect money. Its success spawned a wave of copycats through the mid-2010s.

In 2017, WannaCry marked another shift. This self-replicating cryptoworm spread across networks by exploiting an unpatched Windows vulnerability and infected systems in more than 100 countries within days.

The ransomware-as-a-service model emerged around the same period. It let developers rent ransomware code to affiliates instead of running attacks themselves. From roughly 2019 onward, double extortion became common across major ransomware operations. By the early 2020s, several groups had added triple extortion. Law enforcement has since dismantled or sanctioned several disruptive groups from that period, although former members regularly resurface in newer operations.

Types of ransomware

Most ransomware in circulation falls into a handful of categories. They are distinguished by what they hold hostage and how they pressure the affected organization to pay.

Types of ransomware
Type	What it does	Distinguishing trait
Crypto ransomware	Encrypts files so they can't be opened without a decryption key.	The most common category. Recovery without the key generally isn't possible.
Locker ransomware	Locks the entire device or screen rather than individual files.	Files often remain intact underneath the lock, which can make recovery easier.
Double extortion ransomware	Steals data before encrypting it, then threatens to publish it.	Makes backups alone insufficient because the leak threat persists.
Triple extortion ransomware	Adds a threat against the affected organization's customers or partners on top of double extortion.	Escalates pressure by widening who may be harmed if payment isn't made.
Ransomware-as-a-service (RaaS)	A developer rents out ransomware code and infrastructure to affiliates who run the attacks.	Lowers the technical barrier to launching a campaign. Profits are split between the developer and affiliate.
Wiper disguised as ransomware	Destroys or corrupts data regardless of whether a ransom is paid.	No genuine decryption path exists, even for organizations that pay.

How ransomware gets into a network

Phishing emails carrying malicious attachments or links that install ransomware or an intermediary tool when opened.
Exploited software or operating system vulnerabilities, particularly those left unpatched after a fix is available.
Compromised remote access credentials, often targeting Remote Desktop Protocol (RDP) or VPN logins obtained through credential theft or brute-force attempts.
Other malware already present on the system, used to install ransomware as a second-stage payload.
Drive-by downloads and malvertising, where visiting a compromised site or interacting with a legitimate-looking ad triggers a silent download.
Supply chain compromise, where a trusted vendor's software update is modified to carry ransomware to its customers.

Should an organization pay the ransom?

Law enforcement agencies, including the FBI, consistently discourage paying a ransom. Payment funds further criminal activity, offers no guarantee that a working decryption key will be delivered, and doesn't prevent stolen data from being leaked if a double-extortion threat has already been made. A growing share of affected organizations now refuse to pay, a shift that tracks improvements in backup practices and detection capability more than any change in threat actor behavior.

The decision isn't always straightforward for the organization dealing with the incident. Some sectors have legal reporting obligations regardless of payment. In some jurisdictions, paying a ransom to a group under economic sanctions can itself be illegal. Organizations are generally better served by preparing for this decision in advance as part of an incident response plan than by making it for the first time under pressure during an active attack.

How a SOC detects and responds to a ransomware attack

The period between initial access and encryption is where a ransomware attack is easiest to stop. It is often longer than people assume, because threat actors can spend days or weeks inside a network before deploying the payload.

During this window, behavioral signals such as unusual lateral movement, privilege escalation, large or unusual data transfers, and disabled backup jobs are visible to an EDR agent and a SIEM correlating activity with network and identity telemetry. These signals can appear well before any file is encrypted.

Once encryption starts, detection shifts to recognizing the process itself. A surge of file renames or modifications over a short period is a distinctive pattern that behavior-based endpoint detection can catch and act on directly. Threat intelligence on known ransomware families and their infrastructure helps a SOC triage an alert quickly and anticipate what the threat actor may do next, from data exfiltration to backup deletion.

Sekoia's TDR team runs this detection and response cycle for customers on the Sekoia SOC platform. It correlates EDR, SIEM, and CTI telemetry so early, pre-encryption signals of a ransomware intrusion are surfaced and investigated instead of being discovered only after the ransom note appears.

How to reduce ransomware risk

Maintain offline or immutable backups that ransomware can't reach, encrypt, or delete, and test restoration regularly.
Patch operating systems and internet-facing software on a defined schedule, prioritizing known exploited vulnerabilities.
Require multi-factor authentication on all remote access, especially RDP and VPN logins.
Segment networks so a single compromised system can't reach backup servers or the entire environment.
Filter email for malicious attachments and links, and train employees to recognize phishing attempts.
Deploy endpoint detection and response capable of catching encryption behavior, not only known file signatures.
Build and rehearse an incident response plan that includes the decision to pay or not pay before an attack happens.

Why backups alone don't stop modern ransomware

Backups solve the problem ransomware created a decade ago: losing access to encrypted files. They don't solve the problem it creates now. Once a threat actor has exfiltrated a copy of the data, a clean restore brings systems back online but does nothing about the leak threat hanging over the organization.

That shift is why detecting the intrusion, not only recovering afterward, has become the more decisive control. An organization that catches lateral movement and data staging before encryption starts can stop the leak threat from materializing. An organization that discovers the attack only after files are encrypted is negotiating from a weaker position, whether it has backups or not.

Ransomware FAQ

Is ransomware a type of malware?

Yes. Ransomware is a specific category of malware defined by what it does: it blocks access to data or a device and demands payment for its return. Other malware types, such as spyware or trojans, have different objectives, including surveillance, unauthorized access, or delivery of a second payload. Ransomware is often delivered as that second payload rather than arriving on its own.

What is double extortion ransomware?

Double extortion is a ransomware tactic in which threat actors steal sensitive data before encrypting it, then threaten to publish or sell that data in addition to demanding payment for a decryption key. It removes the protection backups used to provide. Even an organization with reliable backups still faces the threat of a public data leak unless it pays.

Should an organization pay a ransomware demand?

Law enforcement agencies generally advise against paying because payment funds further attacks and doesn't guarantee a working decryption key or prevent stolen data from being leaked. Some organizations pay when the alternative is prolonged downtime with no viable backup. This decision is best made in advance as part of an incident response plan rather than during an active attack.

What is ransomware-as-a-service (RaaS)?

Ransomware-as-a-service is a business model in which a ransomware developer rents out malware, infrastructure, and sometimes support to affiliates. The affiliates carry out the attacks and split the ransom payment with the developer. This model has lowered the technical skill needed to launch a ransomware campaign because affiliates don't need to write code themselves.

Can ransomware be decrypted without paying?

Sometimes. Security researchers and law enforcement partnerships have published free decryption tools for specific ransomware families, usually after finding a flaw in a variant's encryption or seizing its infrastructure. Coverage is inconsistent and depends on the family involved. A working, tested backup therefore remains the more reliable recovery path.

How does ransomware typically get into a network?

Most ransomware intrusions start with phishing, an exploited software vulnerability, or a compromised remote access credential, particularly on RDP or VPN logins. The ransomware itself is often deployed only after the threat actor has spent time inside the network expanding access and locating valuable data to exfiltrate.