https://www.techtarget.com/searchsecurity/definition/ransomware
Ransomware is malware that locks and encrypts a victim's data, files, devices or systems, rendering them inaccessible and unusable until the attacker receives a ransom payment. Malware is the umbrella term for malicious software that enables unauthorized access to IT systems and devices. Ransomware is a form of malware in which attackers demand money to either unlock and decrypt the affected data or return data that has been stolen.
The first iterations of ransomware used only encryption to prevent victims from accessing their files and systems. Victims that had regular backups could restore their data, however, negating the need to pay a ransom. In turn, malicious actors began to incorporate cyber extortion tactics, using additional threats -- such as public disclosure of sensitive data -- to blackmail victims into making ransom payments. Also, attackers started increasingly targeting victims' backups to prevent organizations from restoring their data. Veeam's "2024 Ransomware Trends Report" found 96% of ransomware attacks the previous year specifically targeted backup data.
Ransomware can devastate individuals, organizations and even entire municipalities or countries. Because they continue to be successful, these financially motivated attacks are becoming increasingly common. Verizon's "2024 Data Breach Investigations Report" found ransomware was involved in around one-third of all breaches, and Sophos' "The State of Ransomware 2024" reported 59% of organizations experienced a ransomware attack in the past year, with 70% of those attacks resulting in data encryption.
Read more ransomware trends, statistics and facts.
Every organization faces the risk of experiencing -- almost always with no warning -- a ransomware attack. This guide to ransomware prevention and response further explains what ransomware is and provides a comprehensive overview of the key concepts, trends and strategies driving this difficult and destructive form of cybercrime. Hyperlinks connect to other articles that deliver more in-depth information on the topics covered here.
The ransomware lifecycle has seven general stages: target selection and reconnaissance; malware distribution and infection; command and control; exploration and lateral movement; exfiltration and encryption; extortion; and resolution.
Attackers choose a target and perform reconnaissance. During this phase, attackers gather information about the victim, its systems and potential employees to target for malware distribution. Techniques might include collecting publicly available data, performing network and port scans, and identifying the victim organization's security controls.
In this stage, attackers infiltrate a victim's systems and infect them with malware. The most common ransomware attack vectors are social engineering, compromised credentials, remote desktop software, exploitable software vulnerabilities, and malicious websites and malvertising.
A command-and-control (C&C) server set up and operated by attackers sends encryption keys to the target system, installs additional malware and facilitates other stages of the ransomware lifecycle.
This stage involves attackers moving deeper into the victim's network and extending their reach by elevating their privileges and performing lateral movement attacks.
In this stage, attackers exfiltrate data to the C&C server to use in extortion attacks down the line. They then encrypt the data and systems using the keys sent from their C&C server.
The attackers demand a ransom payment. The organization now knows it is a victim of a ransomware attack.
The victimized organization must act to address and recover from the attack. This could involve restoring data from backups, implementing a ransomware recovery plan, paying the ransom, negotiating with attackers or rebuilding systems from the ground up.
Ransomware is defined and categorized by how it is delivered and what it affects. Delivery includes ransomware as a service (RaaS), automated delivery (not as a service) and human-operated delivery. The impact could be data unavailability, data destruction, data deletion or data exfiltration and extortion -- or all of the above in some cases.
The following terms further describe the different types of ransomware:
Depending on the attack's sophistication, the attacker's motivation and the victim's defenses, the consequences of ransomware can range from minor inconvenience, to expensive and painful recovery, to complete devastation.
When people hear, "We've been hit with ransomware," their minds usually turn to the amount of the ransom demand. The Sophos report found the average ransomware payment in 2024 was just under $4 million, up from $1.5 million the previous year.
The total cost of a ransomware attack, however, far exceeds the ransom price tag. IBM's "Cost of a Data Breach Report 2024" found the average dollar amount attached to a ransomware attack was $5.37 million -- and that doesn't even include the cost of the ransom payment.
The difference can be attributed to multiple factors, including the following:
Ransomware can also have the following effects:
Law enforcement and cybersecurity experts strongly discourage organizations from paying ransoms for the following reasons:
Some businesses still choose to pay the ransom, however. They might think paying results in faster recovery time, reduced revenue loss and reputational damage, lower recovery costs and better protection of customer and employee data.
Read more on ransom payment considerations.
Whether or not a payment is made, security experts and government agencies, including CISA and the FBI, recommend that any organization affected by ransomware notify the authorities. This not only enables law enforcement to track attackers and the threat landscape, but in some cases it also enables them to disrupt ransomware operations. Many agencies also offer support to victims, for example, with incident response and digital forensics.
Note that some organizations are legally required to report ransomware attacks. Public organizations in the U.S., for example, must report material cyberattacks within four business days per Securities and Exchange Commission regulations.
Research has shown that reporting a breach to law enforcement could lessen the cost of a ransomware incident. IBM reported the average $5.37 million cost of a ransomware breach decreased to $4.38 million when law enforcement was involved.
Along with deciding whether to report an attack, decision-makers must discuss whether to disclose it to the public. No national ransomware attack notification law exists for private companies, but if attacks involve personally identifiable information, organizations must notify the individuals affected.
Read more about how and when to report ransomware.
Organizations that choose to pay the ransom sometimes turn to ransomware negotiation services. These specialized third-party brokers act as intermediaries between attackers and victims. Because they are well versed in ransomware groups and their demands, they are better equipped to handle negotiations than most victimized businesses.
Ransomware negotiators help with the following:
Ransomware negotiation services are not always the answer, however. Just as with paying a ransom, negotiations can encourage attackers and won't always result in restored data access.
Read more about what experts have to say about ransomware negotiation strategies.
Cyber insurance has been available since the 1990s but became more popular for organizations around 2020, as the number of ransomware attacks increased. Cyber insurance could cover losses, such as business interruption, incident response, data recovery and reputational harm, as well as regulatory fines, privacy liability, contractual violations and media liability. Policies might also offer pre-breach services such as security awareness training, vulnerability assessments and tabletop exercises.
While insurance can help lessen the financial burden of a ransomware attack, it isn't always easy to find. Insurance companies and brokers have faced significant losses over the past five years, resulting in premium hikes, coverage denials for some customers and even carriers leaving the market.
Clients looking for cyber insurance should read policies carefully. Look for details on coverage omissions, sublimits, war exclusions and preexisting conditions. Also understand insurers' coverage prerequisites, which often include the following:
Read about the state of cyber insurance and get tips on how to find coverage.
While certain industries, such as critical infrastructure, education and healthcare, tend to make the headlines when they become victims of ransomware, it is important to note that no organization -- regardless of size or industry -- is immune to ransomware attacks.
That said, the Sophos report listed the following as the top 13 ransomware targets by sector:
Read more about the top ransomware targets.
Ransomware prevention is a challenge for organizations of all types and sizes and has no magic-bullet remedy. To protect against ransomware, follow these prevention and mitigation best practices:
Even organizations that follow ransomware prevention best practices will inevitably fall victim to attacks. In fact, many experts say companies should consider it not a question of if but of when.
Crucially, however, a security team that detects a ransomware attack in its early stages might be able to isolate and remove malicious actors before they have found, encrypted and exfiltrated sensitive data.
Antimalware tools form an important first line of defense, flagging known ransomware variants based on their digital signatures. Some offerings, such as XDR and SIEM platforms, also scan for behavioral anomalies to catch novel and otherwise unrecognizable ransomware strains. Possible indicators of compromise include abnormal file executions, network traffic and API calls -- any of which could point to an active ransomware attack.
Some organizations use deception-based detection to flush out adversaries, baiting them with fake IT assets that act as tripwires to alert security teams to their presence. While cyber decoys require considerable resources to deploy and maintain, they have exceptionally low false-positive rates, making them valuable weapons in the fight against ransomware.
Ransomware prevention and early detection efforts notwithstanding, experts say enterprises should still expect the worst to happen and plan accordingly. That means organizing a core cybersecurity incident team that investigates security events and an extended computer security incident response team (CSIRT) that responds to confirmed ransomware incidents.
Ideally, the core CSIRT should consist primarily of cybersecurity practitioners and, possibly, IT operations staff. The extended CSIRT should also include legal experts, PR and communications representatives, and executive leaders.
Once the ransomware response plan is in place, regularly put it through its paces with realistic tabletop and threat modeling exercises. Clearly establish how and when to escalate an incident and which CSIRT members should be involved -- at which stages and in what capacity.
During a confirmed ransomware attack, the following should happen as quickly and efficiently as possible.
Learn more about how to remove ransomware.
Read more about how to recover from a ransomware attack.
Ransomware has bedeviled organizations and individuals for decades. The following are just a handful of the most notable ransomware attacks:
So-called big game hunting, in which ransomware operators target large organizations with deep pockets, has exploded in recent years. High-profile ransomware victims have included Colonial Pipeline, Caesars Entertainment, MGM Resorts, JBS USA, the government of Costa Rica, Travelex, the U.K.'s National Health Service and many more.
Ransomware has evolved dramatically since its inception in 1989, when Popp -- the so-called father of ransomware -- loaded the AIDS Trojan onto floppy disks and sent it to targets through snail mail. The birth of the internet and email opened the door to spray attacks, in which threat actors demanded small ransom payments from as many victims as they could. More recently, targeted ransomware attacks have become the norm, taking down one high-profile organization after another.
Several key developments and trends have contributed to the growing tidal wave of ransomware attacks:
AI threatens to turbocharge ransomware attacks by enabling operators to execute them at unprecedented speed and scale. According to experts, generative AI (GenAI) and large language models (LLMs) can help attackers more efficiently and effectively accomplish the following:
GenAI can even help operators optimize their ransom demands based on target-specific variables such as cyber insurance coverage and data backups, while AI chatbots can handle negotiations with victims.
In better news, AI and LLMs also promise to bolster ransomware defenses through intelligent behavioral analysis, automated incident response and recovery, and AI agent-driven endpoint protection. With defenders and threat actors using emerging AI technology against each other in equal measure, their decades-long game of cat and mouse is poised to continue.
Sharon Shea is executive editor of Informa TechTarget's SearchSecurity site.
Alissa Irei is senior site editor of Informa TechTarget's SearchSecurity site.
23 Apr 2025