Ransomware: what it is and how it works

In short

Ransomware has become an industry. Many groups work on a "ransomware as a service" model: those who develop the malware rent it out to affiliates who carry out the attacks and share the proceeds. In double extortion the criminals first copy the data, then encrypt the systems, and finally publish the victim's name on their own leak sites on the dark web, threatening to release the files if the victim does not pay.

How an attack unfolds

1. Initial access: a phishing email, stolen credentials for a VPN or an exposed remote desktop, an unpatched vulnerability on a perimeter device.
2. Exploration and lateral movement: the attacker looks for administrator accounts, servers and network shares, often for days or weeks.
3. Data exfiltration to external servers.
4. Attack on the backups: deletion of the copies reachable from the network and of the Windows recovery copies.
5. Encryption, often at night or at the weekend, and the ransom demand.

Why it matters

Ransomware brings a company to a halt: production, invoicing, email. Paying gives you no certainty: you may not get all the data back, and the stolen data stays in the criminals' hands. Often the event is also a data breach to be assessed and notified under the GDPR, and an incident to be notified for organisations within the scope of NIS2.

The defences that matter most: backups with at least one copy isolated from the network and restores that have actually been tested, multi-factor authentication on remote access and email, prompt updates for exposed systems, network shares with permissions reduced to what is necessary, endpoint monitoring and a business continuity plan that says what to do in the first few hours.

Example

A professional firm exposes its server's remote desktop so that staff can work from home. The administrator's password, reused on another service, ends up in a collection of stolen credentials. An affiliate gets in on a Sunday, copies the client archives, deletes the network-connected backups and encrypts the server. On Monday the firm is at a standstill. Recovery is possible only because a weekly copy was on a disconnected disk: four days of work are lost, and the notification of the personal data breach still has to be handled.

Related terms

• RTO and RPO
• EDR
• MITRE ATT&CK
• CSIRT