What Is Ransomware?

Ransomware encrypts data and demands payment for its recovery. It has been the dominant commercially motivated threat for several years, and the reason is that it converts access into revenue directly, without needing to find a buyer for stolen data.

The operational shape has changed substantially. Modern campaigns steal data before encrypting, which means backups resolve the availability problem and not the disclosure one. For handling an active event, see ransomware response.

The specialised economy behind it

Development groups license their tooling to affiliates who conduct the intrusions and share the proceeds. Access brokers sell footholds obtained separately. Negotiation, laundering and even victim support are separate functions.

That specialisation is why campaigns are competent across the whole chain, and why a low-grade infection months earlier can be the origin of a major encryption event — the access was bought.

How the intrusions actually begin

Stolen or purchased credentials for remote access, which is the most common route and frequently involves no vulnerability. Exploitation of internet-facing services, particularly remote access and file transfer appliances.

Phishing leading to a loader. And third-party access — a managed service provider, a supplier connection, a vendor support channel — which reaches many victims from one compromise.

The dwell time, and what happens during it

Encryption is the last step, frequently days or weeks after entry. During that time the intruder maps the environment, escalates privilege, identifies and steals valuable data, and locates the backup infrastructure.

That period is the detection opportunity, and it is where everything that determines the outcome happens. An organisation that detects during dwell has an incident; one that detects at encryption has a crisis.

Backups decide the recovery, and they are targeted

Attackers locate and destroy backups deliberately, because recoverable victims do not pay. Backups reachable with domain credentials are not backups for this purpose.

What works is copies that a compromise of the production environment cannot reach or alter: immutable storage, separate credentials, offline copies. Plus tested restores, because an untested backup is an assumption.

The controls that most change the outcome

Phishing-resistant authentication on all remote access, which closes the most common entry route. Rapid patching of internet-facing services. Immutable, tested backups. Segmentation, which bounds how far encryption reaches.

And detection capable of noticing the dwell period — privilege escalation, unusual internal reconnaissance, large outbound transfers, backup system access from unusual sources.

Extortion without encryption

Some campaigns now skip encryption entirely: steal the data, demonstrate possession and demand payment to prevent publication. It is simpler, faster, less disruptive to detect and entirely unaffected by the quality of your backups.

That shift matters because backup investment, which is the right answer to encryption, does nothing here. The controls that address it are the ones that prevent or detect bulk data leaving — egress control, data loss prevention, and monitoring for large outbound transfers.

Where to start

Confirm that a copy of your backups cannot be deleted or encrypted by anyone holding domain administrator credentials, and that a restore has been tested this year.

See prevention and recovery and immutable backups. GuardsArm delivers incident response.