Ransomware

Layer 7: Application High risk

How it works

Ransomware usually arrives through a door that was already open: a phishing email, stolen passwords, an exposed remote access service or an unpatched firewall. Once inside, attackers often spend days or weeks quietly exploring the network, finding valuable data, disabling security tools and locating backups. Many modern groups operate as a business, renting out their tools to affiliates who handle the break-in and share the profits.

When the attackers are ready, they launch encryption across as many servers and workstations as possible, usually outside business hours. A ransom note then appears with payment instructions. Most groups now steal a copy of your data first, so even organizations with good backups face a second threat: pay, or see client records, financial files and employee information published. Paying does not guarantee recovery and may fund further attacks.

Warning signs

• Files suddenly renamed with unfamiliar extensions or that will not open
• Antivirus or backup software disabled without explanation
• Unusual sign-ins or new administrator accounts appearing
• Large, unexpected outbound data transfers, especially overnight
• Ransom notes appearing as text files or desktop wallpaper

How to defend against it

• Keep offline or immutable backups and test restores regularly
• Require multi-factor authentication on email, remote access and admin accounts
• Patch internet-facing systems quickly and remove exposed remote access
• Deploy endpoint detection and response with 24/7 monitoring
• Limit administrator rights and segment the network
• Train staff to recognize and report phishing

If it happens to you

1. Disconnect affected devices from the network but leave them powered on
2. Call your IT or incident response provider before touching anything else
3. Do not contact the attackers or pay without expert and legal advice
4. Preserve evidence and begin assessing privacy breach reporting obligations