What Is Ransomware and How Can Users Reduce Their Risk?

What Ransomware Does

Ransomware is a type of malware that encrypts a victim's files — making them unreadable without a specific decryption key — and then demands payment, usually in cryptocurrency, in exchange for that key. Some variants also steal a copy of the data beforehand and threaten to publish it, a tactic often called "double extortion," which adds pressure even for victims who have working backups.

How Ransomware Typically Spreads

Common entry points include phishing emails with malicious attachments or links, software vulnerabilities that haven't been patched, weak or reused remote-desktop credentials, and malicious advertisements or compromised downloads. Once inside a single device, some ransomware variants attempt to spread further across a shared network by exploiting the same kinds of vulnerabilities or credentials on other connected machines.

The Ransomware Lifecycle

Understanding the stages helps explain why different defenses matter at different points:

1. Initial access — the malware gets onto a device, often through phishing or an unpatched vulnerability.
2. Establishing persistence — it ensures it can survive a reboot and often tries to disable or evade security software.
3. Lateral movement (in networked environments) — it attempts to spread to other devices sharing the network.
4. Encryption — files are encrypted rapidly, often targeting document, image, and database file types specifically.
5. Ransom demand — a note is left explaining how to pay and, supposedly, receive a decryption key.

Behavioral detection, discussed in our malware detection guide, is aimed specifically at catching stage four — the encryption pattern itself — since that behavior is hard to disguise even in previously unseen ransomware variants.

Why Paying the Ransom Is Discouraged

Law enforcement agencies and security researchers generally advise against paying, for several practical reasons: there is no guarantee the attacker will actually provide a working decryption key, payment funds further criminal activity, and victims who pay are sometimes targeted again in the future, having demonstrated willingness to pay. Some jurisdictions also have legal restrictions on payments to certain sanctioned groups.

Backups: The Single Most Effective Defense

Because ransomware's core threat is data loss, a reliable backup is the most direct countermeasure — it removes the leverage a ransom demand depends on. The generally recommended approach is the "3-2-1" rule: at least three copies of important data, on two different types of storage media, with at least one copy kept offline or otherwise disconnected from the main network. An always-connected backup drive can itself be encrypted by ransomware if it's reachable at the time of infection, which is why the offline or disconnected copy matters specifically.

Practical Ways to Reduce Your Risk

• Keep an offline or cloud backup that isn't constantly connected to your main device.
• Install operating system and software updates promptly, since many ransomware campaigns exploit known, already-patched vulnerabilities.
• Be cautious with email attachments and links, particularly unexpected ones, as covered in our phishing recognition guide.
• Use unique, strong passwords for remote access tools and enable multi-factor authentication where available.
• Enable a behavioral ransomware protection feature if your security software or operating system offers one, such as Windows' Controlled Folder Access.

If You Think You're Infected Right Now

1. Disconnect the device from Wi-Fi or unplug the network cable to limit further spread or communication with attackers.
2. Do not pay the ransom immediately or interact with the demand before getting advice.
3. If this is a work device, contact your IT or security team immediately rather than attempting to resolve it alone.
4. For a personal device, consider contacting a professional data-recovery or incident-response service, and check whether a free decryption tool exists for the specific ransomware variant through resources such as the No More Ransom project, a collaboration between law enforcement and security companies.
5. Once resolved, restore files from a known-clean backup rather than trusting files that were present during the infection.

Frequently Asked Questions