Understanding Ransomware

What it actually does, step by step

Most incidents follow a similar arc. Someone gets in — often through a stolen password, sometimes through an unpatched server, occasionally through an email attachment. Nothing happens for days or weeks while the attacker explores.

During that quiet period they escalate privileges, find where the backups live, and deliberately disable or delete them. Only then do they encrypt everything. This is why 'we have backups' is not automatically a defence — the first thing a competent attacker does is look for and destroy them.

Finally they leave a note. The countdown starts. Some groups now also steal data first and threaten to publish it, so paying for a decryption key no longer guarantees your information stays private.

How it usually gets in

The three most common entry points are unpatched internet-facing systems (VPNs and remote access gateways especially), credentials stolen through phishing, and credentials reused from an unrelated breach somewhere else.

The last one surprises people. A password you used on some shopping site in 2019, reused for a work account, is a real and frequent path into a business network. Attackers buy enormous lists of leaked credentials and simply try them everywhere.

This is why multi-factor authentication matters so much. When a password alone is not enough to log in, a stolen password becomes much less useful.

What actually protects you

Tested backups are the single most important control, and the word doing the work there is 'tested'. A backup nobody has ever restored from is a belief, not a backup. Test one file, then one folder, then a whole system — and confirm the backup copies cannot be deleted using the same credentials that run your network.

Second is multi-factor authentication on email, remote access, and administrative accounts. Email first, because a compromised mailbox lets an attacker reset almost everything else.

Third is simply keeping systems patched. Most successful attacks use vulnerabilities that had a fix available for weeks or months beforehand. Patching is unglamorous and it is most of the job.

If it happens to you

Disconnect the affected machines from the network immediately — pull the cable or disable Wi-Fi. Do not shut them down; memory can contain evidence that helps with recovery, and some encryption schemes can be partially undone while the machine is still running.

Call for help before you do anything else, and do not pay quickly. Notify your insurer if you carry cyber coverage — many policies require prompt notification and pre-approval of recovery vendors.

Then work the recovery: identify the encrypted data, confirm the integrity of your backups, and restore in an isolated environment before putting anything back on the network.