Ransomware has shut down hospitals, paralyzed governments, and cost businesses billions of dollars — all from a single click on the wrong email. It's one of the most destructive and fastest-growing threats in cybersecurity today. This guide explains exactly how it works, who gets hit, and what you can do to protect yourself.
Bottom line up front: Ransomware is malware that encrypts your files and demands payment — usually in cryptocurrency — to restore access. Even if you pay, there's no guarantee you'll get your data back. Prevention is everything.
Ransomware attacks follow a predictable playbook. Understanding each stage is the first step to stopping one.
The attacker gets a foothold — usually via a phishing email with a malicious attachment or link, an exposed RDP port with a weak password, or a vulnerability in unpatched software. This is where most attacks begin.
The victim opens the file or the attacker exploits the vulnerability. The ransomware payload executes on the system, often disguised as a legitimate document or software update.
Modern ransomware doesn't encrypt right away. It quietly moves through the network — spreading to other machines, stealing credentials, and identifying the most critical data to maximize leverage. This phase can last days or weeks undetected.
Before encrypting, attackers often steal a copy of your sensitive data. This enables "double extortion" — pay to decrypt your files AND pay to prevent us from publishing your data publicly.
The ransomware encrypts files across the network using strong asymmetric encryption (typically RSA or AES). Without the attacker's private key, the files are mathematically unrecoverable. The attack is now visible — every encrypted file gets a new extension and a ransom note appears on the desktop.
A ransom note instructs the victim to contact the attackers via a Tor-based website and pay in Bitcoin or Monero — typically anywhere from a few hundred dollars (personal victims) to millions (enterprises and hospitals).
The most common and destructive type. Encrypts your files — documents, photos, databases — making them completely inaccessible. WannaCry, REvil, and LockBit are all crypto ransomware families. Your system still boots, but your data is gone until you pay or restore from backup.
Locks you out of your entire device rather than encrypting files. You can't log in or use the system at all. More common on mobile devices and older attacks. Generally easier to recover from than crypto ransomware.
Encrypts your data AND threatens to publish it publicly if you don't pay. Popularized by groups like Maze in 2019, now the industry standard for professional ransomware gangs. Even if you have backups, they can still leak your data.
The business model behind most modern attacks. Ransomware developers lease their malware to affiliates who carry out attacks in exchange for a cut of the ransom (typically 20–30%). This is why ransomware attacks are so frequent — you don't need to code anything, just buy access. LockBit, BlackCat, and Cl0p all operated as RaaS platforms.
Targets Android devices more than iOS due to sideloading. Usually locker-style rather than crypto. Often disguised as fake apps or system updates downloaded outside the official app store. Less devastating than enterprise attacks but increasingly common.
These aren't hypotheticals — ransomware has caused real, documented harm at massive scale:
| Attack | Year | Impact |
|---|---|---|
| WannaCry | 2017 | 200,000+ systems in 150 countries. Hit the UK's NHS, disrupting hospitals and patient care. |
| NotPetya | 2017 | $10 billion in damages. Wiped entire organizations including Maersk shipping and Merck pharmaceutical. |
| Colonial Pipeline | 2021 | Shut down fuel supply to the US East Coast for 5 days. $4.4M ransom paid (partially recovered by FBI). |
| Change Healthcare | 2024 | Largest healthcare data breach in US history. Disrupted prescription processing across the country for weeks. |
| MGM Resorts | 2023 | Started with a social engineering call. Caused $100M+ in losses, slot machines and hotel systems offline for days. |
Should you pay the ransom? Law enforcement agencies including the FBI recommend against it. Payment funds criminal operations, marks you as a willing payer (increasing future targeting), and roughly 20% of victims who pay never recover their data anyway. Always explore recovery options first.
Early ransomware sprayed attacks broadly and hoped for small payments from individuals. Modern ransomware gangs are far more strategic — they call it "big game hunting":
That said, individuals are still targeted — particularly through opportunistic phishing campaigns and malvertising. No one is completely off the radar.
The good news: the vast majority of ransomware attacks are preventable with consistent, basic security hygiene.
The single most effective defense: Offline, tested backups. Everything else reduces the likelihood of infection — backups are what save you when prevention fails. If you do nothing else, set up automatic backups today.
Ransomware is one of the most relevant threats you'll encounter in almost any security role. As a SOC Analyst, you'll investigate ransomware incidents, analyze indicators of compromise, and work to contain infections. Incident response to ransomware is one of the most in-demand and well-paid specializations in the industry right now.
On TryHackMe, the Malware Analysis and Incident Response paths cover ransomware behavior in a hands-on lab environment. Understanding how ransomware operates is also heavily tested on the CompTIA Security+ exam.
Ransomware also overlaps heavily with social engineering — most infections start with a phishing email, making the human layer just as important as technical defenses.
Ransomware is the most financially damaging form of cybercrime in the world right now, and it's not slowing down. The groups behind these attacks are sophisticated, well-funded, and increasingly targeting critical infrastructure. But the fundamentals that stop them haven't changed: patch your systems, back up your data, train people to recognize phishing, and lock down remote access.
You don't need a million-dollar security stack to dramatically reduce your risk. You need consistent habits and a plan for when — not if — something gets through.
Your next step: Set up automatic backups right now if you haven't. On Windows, use File History or back up to an external drive plus a cloud service like Backblaze. On Mac, enable Time Machine. It takes 10 minutes and could save everything.