Ransomware

Ransomware is software that locks a company's or a person's files and demands money to unlock them. It locks the files by encrypting them, which means scrambling them so that they can be read only with a secret key. The attackers keep the key. They leave a message that asks for a ransom, usually in cryptocurrency, in exchange for the key.

Here is how an attack typically unfolds. An attacker first gets in, often through a phishing email or a stolen password. For several days, the attacker looks around the network for the important servers. In many attacks, the attacker also copies the victim's data out. Then, often on a weekend night, the ransomware encrypts thousands of files at once. The next working day, staff cannot open their systems or shared drives, and a message demands a ransom. If the victim refuses, the attackers threaten to publish the stolen data. This is called double extortion.

Paying is risky. The attackers may not send a key that works, and they may attack again. So companies defend themselves in layers. An endpoint detection and response (EDR) agent on every laptop and server watches what programs do. If a program starts encrypting many files quickly, the agent stops it and cuts the machine off from the network. Most important is a backup that the attacker cannot change. Immutable backups cannot be changed or deleted once written, even with the administrator's password. An air-gapped backup is kept where an attacker inside the network cannot reach it. Ransomware recovery restores the systems from these clean backups. Afterwards, digital forensics works out how the attacker got in. In India, companies must report such an incident to CERT-In, the government's cyber security agency, within six hours.

Take, for example, a hospital whose patient records are encrypted. Doctors must go back to paper notes until the systems are restored.

Consider a home laptop. A fake invoice email can install ransomware that encrypts years of family photos, and only a copy kept somewhere else brings them back.

Say a factory's production line stops because the computers that plan it are encrypted. Every hour of waiting costs money, which is why attackers choose businesses that cannot stop for long.

How is ransomware different from other attacks? Many attacks steal data quietly and hope not to be noticed. Ransomware wants to be noticed: it stops the business, so that the victim feels it must pay. It uses the same encryption that protects your data every day, but the attacker holds the key.