Ransomware Explained: How It Works and How to Defend

Ransomware is a category of malware that encrypts a victim's files or locks entire systems and then demands payment in exchange for restoring access. It has become one of the most financially damaging threats facing organizations, because a single successful intrusion can halt operations, expose sensitive data, and impose severe recovery costs. Understanding how ransomware works, how it spreads, and how to defend against it is essential for anyone building a resilient security program.

How Ransomware Works

At its core, ransomware denies a victim access to their own data or systems until a ransom is paid. The most common variety, often called crypto ransomware, encrypts files on local drives, mapped network shares, and reachable backups. A less sophisticated variety, locker ransomware, blocks access to the device interface without necessarily encrypting individual files.

The Hybrid Encryption Model

Effective ransomware relies on hybrid cryptography that makes recovery without the attacker's cooperation practically impossible:

• A fast symmetric cipher such as AES generates a unique key and encrypts the victim's files.
• That symmetric key is then encrypted with an attacker-controlled asymmetric public key such as RSA or an elliptic-curve algorithm.
• Only the attacker holds the corresponding private key needed to recover the symmetric key.

Because the symmetric key never remains on disk in usable form, victims cannot simply extract it afterward. Poorly implemented ransomware sometimes reuses keys or relies on weak randomness, which occasionally enables free decryption tools — but well-built samples leave no such shortcut.

The Ransomware Attack Lifecycle

Ransomware is rarely a single automated event. Human-operated campaigns follow a recognizable sequence:

1. Initial access through phishing, stolen credentials, exposed remote services, or exploited vulnerabilities.
2. Execution and persistence, establishing a foothold that survives reboots.
3. Privilege escalation to gain administrative or domain-level control.
4. Lateral movement across the network to reach high-value systems.
5. Data exfiltration, copying sensitive files before anything is encrypted.
6. Deployment, disabling defenses and backups before triggering mass encryption.
7. Extortion, delivering a ransom note with payment instructions.

Many intrusions dwell for days or weeks before encryption, which gives defenders a valuable window to detect and disrupt the attack.

Common Infection Vectors

• Phishing emails carrying malicious attachments or links are a leading entry point. See our guide to phishing attacks.
• Exposed remote access such as unsecured RDP or VPN endpoints protected only by weak or reused passwords.
• Unpatched vulnerabilities in internet-facing applications and services.
• Compromised software supply chains and malicious updates.
• Commodity malware and botnets that sell access to already-compromised machines.

Extortion Models

• Single extortion simply encrypts data and demands payment for a decryption key.
• Double extortion adds data theft, threatening to publish stolen information if the victim refuses to pay — which defeats a "just restore from backup" response.
• Triple extortion layers on additional pressure such as denial-of-service attacks or direct contact with a victim's customers and partners.
• Ransomware-as-a-service (RaaS) is a criminal business model in which developers lease their malware to affiliates and split the proceeds, lowering the barrier to entry.

How to Detect Ransomware

Detection focuses on behavior rather than static signatures, because file-encrypting activity produces distinctive patterns:

• Rapid mass file modification and a surge in filesystem entropy as readable files become ciphertext.
• Shadow copy and backup deletion, a near-universal precursor to encryption.
• Suspicious use of legitimate tools for discovery, credential theft, and lateral movement.
• Unusual outbound transfers consistent with data exfiltration.

A classic host indicator is the deletion of Windows Volume Shadow Copies to prevent easy rollback:

vssadmin.exe delete shadows /all /quiet

Alerting on this command, on bulk file renames, and on the disabling of security services gives defenders early warning. Endpoint detection and response (EDR) tools and honeypot canary files that trigger an alert when modified are effective tripwires.

How to Defend Against Ransomware

No single control stops ransomware; resilience comes from layered defenses:

1. Maintain tested, offline backups. Follow a 3-2-1 approach and keep at least one immutable or air-gapped copy that ransomware cannot reach or delete.
2. Reduce the attack surface. Patch promptly, disable unused services, and never expose RDP directly to the internet.
3. Enforce strong authentication. Require multi-factor authentication everywhere, especially for remote access and privileged accounts.
4. Apply least privilege and segmentation so a single compromised host cannot reach the entire estate.
5. Filter email and block risky content such as macro-enabled attachments from untrusted sources.
6. Deploy EDR and centralized logging to catch the behavioral precursors described above.
7. Prepare and rehearse an incident response plan, including isolated recovery procedures.

Paying a ransom is discouraged: it funds further crime, offers no guarantee of recovery, and marks the victim as willing to pay again.

Key Takeaways

• Ransomware encrypts or locks data and extorts victims, using hybrid cryptography that makes unauthorized decryption impractical.
• Human-operated attacks follow a multi-stage lifecycle, often dwelling in the network before encryption and stealing data for double extortion.
• Detection is behavioral: watch for mass file changes, shadow copy deletion, and abuse of legitimate administrative tools.
• Reliable, immutable, offline backups are the single most important recovery control.
• Layer patching, MFA, least privilege, segmentation, and EDR, and rehearse an incident response plan before an attack occurs.