Overview
Direct Answer
Ransomware is malicious software that encrypts or locks a victim's data, rendering it inaccessible, and demands payment in exchange for decryption or restoration. Modern variants often exfiltrate sensitive files before encryption, enabling double-extortion attacks that threaten public disclosure alongside operational disruption.
How It Works
Ransomware typically enters systems through phishing, unpatched vulnerabilities, or compromised credentials, then executes encryption algorithms against files and databases whilst evading detection. The attacker maintains exclusive possession of decryption keys and communicates ransom demands via anonymous channels, often leveraging cryptocurrency for untraceable payment.
Why It Matters
Organisations face severe operational downtime, regulatory penalties, reputational damage, and financial loss through ransom payments and recovery costs. Critical sectors including healthcare, finance, and energy infrastructure report significant disruption, making ransomware defence a board-level priority and compliance requirement under data protection frameworks.
Common Applications
Manufacturing facilities have experienced production halts; hospitals have diverted emergency patients; local government services have suspended citizen-facing operations. Financial institutions, law enforcement, and supply chain operators all report high-impact incidents affecting service continuity and data integrity.
Key Considerations
Paying ransoms does not guarantee decryption key delivery and may fund further criminal activity; moreover, some jurisdictions restrict ransom payments through sanctions enforcement. Organisations must balance immediate recovery pressure against long-term strategic defences including air-gapped backups, segmentation, and threat intelligence.
More in Cybersecurity
Buffer Overflow
Offensive SecurityA programming error where data written to a buffer exceeds its capacity, potentially allowing code execution.
Supply Chain Attack
Offensive SecurityA cyberattack targeting the less-secure elements of a supply chain to compromise a primary target.
Cloud-Native Application Protection
Offensive SecurityAn integrated security platform that protects cloud-native applications across the full lifecycle, combining workload protection, configuration management, and runtime security.
Next-Generation Firewall
Defensive SecurityAn advanced firewall that goes beyond traditional packet filtering to include application awareness and intrusion prevention.
Deception Technology
Identity & AccessSecurity solutions that deploy decoy assets such as fake servers, credentials, and data to detect, misdirect, and analyse attackers who have breached perimeter defences.
Honeypot
Defensive SecurityA decoy system designed to attract attackers and study their methods while protecting real systems.
Threat Hunting
Defensive SecurityThe proactive search for cyber threats within an organisation's environment that have evaded automated detection, using hypotheses, threat intelligence, and advanced analytics.
Man-in-the-Middle Attack
Offensive SecurityAn attack where the attacker secretly relays and potentially alters communication between two parties.