PATCH//NOTES Open the interactive version
← All lessons
Threats · Beginner · 4 min

Ransomware

Encrypt everything, steal a copy, then demand payment twice.

What it is

Ransomware is malware that encrypts an organisation's files so they can't be used, then demands payment for the key. Modern gangs also steal the data first and threaten to publish it (double extortion). Most groups run as businesses: developers rent the ransomware to 'affiliates' who break in, often through stolen passwords, unpatched VPNs or phishing, then spend days quietly spreading before they strike.

See it: How a ransomware attack reaches the point of encryption

  1. Affiliate → VPN / remote access: Logs in with a stolen password. Many attacks start at remote access: a reused password or an unpatched VPN. Stopped by: MFA on every remote access point; patch internet-facing systems first.
  2. VPN / remote access → File servers: Spreads quietly for days. The attacker gains admin rights and maps the network before doing anything noisy. Stopped by: Segment networks and give accounts only the access they need.
  3. File servers → Affiliate: Copies data out. Data is stolen first so the gang can threaten to leak it (double extortion). Stopped by: Watch for unusual large outbound transfers.
  4. Affiliate → Backups: Deletes reachable backups. Gangs destroy backups they can reach so the victim can't simply restore. Stopped by: Keep offline or immutable backups and test restoring them.
  5. Affiliate → File servers: Encrypts files, leaves a ransom note. Files become unusable and the ransom demand appears. Stopped by: EDR that spots mass file changes can stop encryption early.

Step through the animated diagram in the app.

Real case · 2021

Colonial Pipeline

Attackers logged in to an old VPN account with a leaked password and no MFA. The resulting ransomware attack shut down the largest fuel pipeline in the US for days and caused fuel shortages along the East Coast.

Source: Wikipedia: Colonial Pipeline ransomware attack

How defenders stop it

  • Offline or immutable backups that are tested regularly
  • MFA on every remote access point (VPN, RDP, email)
  • Patch internet-facing systems first, especially anything on CISA's KEV list
  • Endpoint detection (EDR) and watching for mass file changes

Try it yourself

See free decryptors at No More Ransom

Check yourself

1. Why aren't backups alone enough against modern ransomware?

  1. Backups are always encrypted too
  2. Gangs also steal data and threaten to leak it
  3. Backups are illegal to restore
  4. Ransomware deletes the internet connection
Show answer

Gangs also steal data and threaten to leak it. Double extortion means restoring from backup doesn't stop the leak threat.

2. In ransomware-as-a-service, who usually breaks into the victim's network?

  1. The ransomware's developers
  2. Affiliates who rent the ransomware
  3. The antivirus vendor
  4. The victim's IT team
Show answer

Affiliates who rent the ransomware. Developers rent the ransomware to affiliates, who break in, often with stolen passwords or unpatched VPNs, and spread before striking.

3. Which backups are most likely to survive a ransomware attack?

  1. Files in the Recycle Bin
  2. A copy on the same server
  3. Offline or immutable backups that are tested regularly
  4. Backups on a mapped network drive
Show answer

Offline or immutable backups that are tested regularly. Gangs hunt for reachable backups and destroy them. Offline or immutable copies can't be changed, and testing proves they actually restore.

Answer them in the app to earn XP.

Next: Malware families →