knowledge
Overview
Ransomware is malware that infiltrates systems or networks, encrypts files to make them inaccessible, and demands a ransom payment — typically in cryptocurrency — in exchange for the decryption key. It is one of the most damaging forms of cyberattack due to its ability to halt operations completely and its financial, reputational, and in some cases life-threatening consequences.
Terminology
| Term | Definition |
|---|
| Ransomware | Malware that encrypts victim data and demands payment for the decryption key |
| Encryption | Process of scrambling data so it is unreadable without the correct key |
| Decryption Key | The key required to reverse encryption and restore access to files |
| Cryptocurrency | Digital currency used in ransom payments due to its pseudonymous nature |
| Double Extortion | Attackers both encrypt data and threaten to publicly release stolen data if ransom is unpaid |
| Ransomware-as-a-Service (RaaS) | Criminal business model where ransomware is sold or leased to other attackers |
Core Concepts
How Ransomware Works
| Stage | Description |
|---|
| Infiltration | Enters via phishing, exposed RDP, malicious downloads, or supply chain compromise |
| Propagation | Spreads laterally across the network to maximize the number of encrypted systems |
| Encryption | Encrypts files across servers, endpoints, and backups |
| Ransom Demand | Attacker presents payment instructions — usually cryptocurrency to a specific wallet |
| Payment / Recovery | Victim pays (no guarantee key is provided) or recovers from clean backups |
Attacker Motivation
| Motivation | Description |
|---|
| Financial Gain | Primary driver — ransomware is a highly profitable criminal model |
| Disruption | Critical infrastructure (hospitals, utilities, government) targeted for maximum leverage |
| Extortion | Double extortion threats increase pressure to pay even if backups exist |
Impact
| Impact Area | Description |
|---|
| Financial | Ransom payment, recovery costs, lost revenue during downtime |
| Operational | Systems offline; staff unable to work until recovery is complete |
| Data Loss | Permanent data loss if backups were also encrypted or deleted |
| Reputational | Customer and partner trust damaged by breach and outage |
| Life Risk | In healthcare environments, encrypted systems directly impact patient care |
References / Images
