Malware and cyber defence, explained
How does ransomware work?
Ransomware is malware that encrypts a victim's files and demands payment for the key to unlock them. A modern attack is not one click: attackers get in, take control of the network, steal data, destroy backups and only then encrypt everything at once, so they can demand payment both to restore the files and to keep the stolen data private.
The six stages of a ransomware attack
Each stage gives defenders a chance to stop the attack, and the earlier the better. Encryption is the last stage, not the first.
| Stage | What the attackers do | What stops it |
|---|---|---|
| 1. Initial access | Attackers get a first foothold: a phishing email, a stolen password for a VPN or remote desktop without multi-factor authentication, or an unpatched internet-facing server. Some gangs buy this access from specialists. | Multi-factor authentication on every remote login; patching internet-facing systems first; phishing awareness. |
| 2. Taking control | From one machine, they steal more passwords (often from memory) until they hold an administrator account. | Separate admin accounts used only for admin work; EDR alerts on credential theft. |
| 3. Spreading through the network | They map the network and log in to servers with the accounts they stole, using normal admin tools so they blend in. | Network segmentation; alerts when one account logs in to many machines. |
| 4. Stealing data | They copy sensitive files out, often to cloud storage, so they can threaten to publish them. This is called double extortion. | Monitoring for large uploads; keeping sensitive data where few accounts can reach it. |
| 5. Destroying the way back | They delete shadow copies and backups they can reach, and switch off security tools. | Offline or immutable backups that an admin account on the network cannot delete. |
| 6. Encryption and extortion | Usually at night or on a weekend, they encrypt every machine at once and leave a ransom note with a deadline and a link to their leak site. | An incident response plan practised in advance, and restoring from clean backups. |
A real case: in May 2021 the attackers behind the Colonial Pipeline ransomware got in with the password of an unused VPN account that had no multi-factor authentication. The largest refined-fuel pipeline in the US shut down for five days. Stage 1 was the cheapest place to have stopped it.
How the encryption works
Ransomware uses the same strong encryption that protects online banking, which is why files cannot be cracked open afterwards.
- Each file is encrypted with a fast symmetric key (such as AES or ChaCha20), often a different key per file.
- Those file keys are then encrypted with the attackers' public key. Only their private key, which never touches the victim's network, can unlock them.
- The original files are overwritten or deleted, so the encrypted copies are all that remain.
Done properly, this is unbreakable without the private key. Free decryptors exist only when a gang made a mistake or its keys were seized by police. The real way back is a backup the attackers could not reach, which is what the 3-2-1 backup rule is for.
Ransomware as a service
Most ransomware attacks are run by affiliates who rent the malware from its developers and split each ransom with them. Separate criminals sell the initial access, and others launder the payments. This division of labour is why attacks are so frequent, and why taking down one group rarely ends the problem: the affiliates move to another brand.
What to do if ransomware hits
- Disconnect, do not switch off. Unplug affected machines from the network and Wi-Fi, but leave them powered on: memory can hold evidence, and sometimes keys.
- Call your incident response lead, your IT provider or your cyber insurer's hotline.
- Report it to the police or national cyber agency: in the US the FBI at ic3.gov, in the UK the NCSC and Action Fraud.
- Check nomoreransom.org for a free decryptor for the strain on the ransom note.
- Restore from clean backups, after finding and closing the way in, or the attackers return.
The full process is in incident response steps. For how ransomware changed over the years, from CryptoLocker to WannaCry to MOVEit, see the famous malware attacks timeline.
Questions people ask
Should you pay a ransomware ransom?
Law enforcement agencies, including the FBI and the UK National Cyber Security Centre, advise against paying. Payment does not guarantee a working key or that stolen data is deleted, and it funds the next attack. Some payments can also break sanctions law. Report the attack to the police or national cyber agency first.
Can ransomware be removed without paying?
The malware itself can usually be removed, but removing it does not decrypt the files. Files come back from backups, or occasionally from a free decryptor when researchers have broken a particular strain: the No More Ransom project collects them at nomoreransom.org.
Can ransomware infect phones?
Android ransomware exists, though most of it locks the screen rather than encrypting files. iPhones are rarely affected. The ransomware that causes serious damage targets company networks and Windows servers.
How long does a ransomware attack take?
It varies from hours to weeks. The encryption itself is fast, often minutes, but it comes at the end. The time attackers spend inside the network before it is the window in which defenders can catch them.