What Is Ransomware and How Does It Work?

What is ransomware?

Ransomware is a type of malicious software designed to block access to data, files, and/or an entire computer system until a sum of money is paid. Ransomware is known to target organizations that have perceivably weak cybersecurity systems and the ability to pay large ransoms.

How does ransomware work?

There are a number of ways ransomware can infect your computer or organization. One of the most common methods is phishing, in which victims are sent emails with attachments that look trustworthy but are actually malware in disguise.

Once the attachments are downloaded and opened, they can start to infiltrate the victim’s computer, locking up programs and/or encrypting files to restrict access. Some ransomware attacks have built-in social engineering tools that trick victims into granting administrative access and passwords to the network, which can enable the malware to spread to other computers in the organization.

Stages of a ransomware attack

1. Infection: The attacker gains entry, often through phishing emails or exploiting vulnerabilities.
2. Execution: The ransomware encrypts files or locks access to the system.
3. Demand: The attacker demands a ransom, often in cryptocurrency.
4. Payment: The victim may or may not comply with the ransom payment request.
5. Decryption (or failure): If paid, the attacker may send a decryption key, or the victim may be left without access to the data.