Ransomware is malicious software that makes data or systems unusable, usually by encrypting them, and demands payment for restoring access. For several years the encryption has been only half of the threat. The US Cybersecurity and Infrastructure Security Agency (CISA) describes the now-common combination of locking files and stealing them as “double extortion”: attackers threaten to publish the stolen data if the victim does not pay, and in some cases they steal and threaten without encrypting anything at all.
How intrusions begin
CISA’s #StopRansomware Guide organizes its advice around the ways attackers typically get in:
- Internet-facing vulnerabilities and misconfigurations, including exposed remote-access services and VPNs.
- Compromised credentials, such as stolen or reused passwords.
- Phishing, meaning deceptive messages that deliver malware or capture logins.
- Precursor malware, where an existing infection hands access to a ransomware group. The guide names QakBot, Bumblebee and Emotet as examples.
- Advanced forms of social engineering, targeted deception that goes beyond ordinary phishing.
- Third parties and managed service providers, whose own access to a customer network becomes a way in.
The point of the list is that none of these routes requires a sophisticated exploit. Most are ordinary hygiene failures.
What happens after the break-in
Attackers rarely strike immediately. They look around the network, raise their privileges, find the systems that matter and, as CISA notes, go looking for backups. The guide warns that many ransomware variants try to find and then delete or encrypt any backups they can reach. Only when they are ready do they copy data out and trigger encryption across many machines at once.
The delay between entry and visible damage is an opportunity. Unusual administrator activity, new accounts and large outbound transfers can all give defenders a chance to act before the ransom note appears.
Backups that survive the attack
Backups remain the most important tool for recovery, but the details decide whether they work. CISA’s guide says to maintain offline, encrypted backups of critical data and to regularly test their availability and integrity in a disaster recovery scenario. Offline matters because a backup that is reachable from the compromised network can be destroyed along with everything else. Testing matters because an untested backup is an assumption.
Backups cannot undo data theft, which is why they are one defense among several.
The measures agencies keep repeating
CISA’s recommended controls read like a checklist of things many organizations already know but have not finished:
- Do not expose services such as remote desktop to the internet.
- Use phishing-resistant multi-factor authentication for all services, starting with email and remote access. Our guide to multi-factor authentication methods explains the differences.
- Require unique passwords of at least 15 characters.
- Patch internet-facing systems promptly, prioritizing vulnerabilities known to be exploited.
- Limit privileges, separate administrator accounts and segment the network to limit lateral movement.
- Deploy endpoint detection tools and filter email attachments.
Phishing remains a leading entry route, and the messages are becoming harder to spot, as we explain in our piece on AI-assisted phishing.
Should a victim pay?
The FBI does not support paying a ransom. Its reasoning, set out across its advisories, is that payment does not guarantee the files come back, can encourage further attacks, and funds criminal activity. The bureau also acknowledges the pressure organizations are under when they cannot operate, and it recognizes that executives will weigh every option. In practice the decision involves lawyers, insurers, incident responders and law enforcement, and the FBI asks victims to report incidents whether or not they pay, because reports help investigators track attackers and sometimes recover funds or find decryption keys.
A plan made before the attack
Organizations that recover well tend to have rehearsed. A basic plan names who is in charge, how to isolate affected systems, who to call, how staff will communicate if email is down and where printed contact details are kept. CISA’s guide also advises consulting federal law enforcement early, even when other mitigation looks possible, because a decryptor may exist.
This is general information, not a substitute for professional security advice.
