What Is Ransomware? How It Works, Examples and How to Recover

What Ransomware Is

Ransomware is a category of malware whose business model is extortion. After running on a computer or network, it encrypts documents, databases and backups, then displays a note demanding payment, usually in cryptocurrency, in return for a key. Victims range from individuals whose photos are locked to hospitals whose patient systems stop working, factories whose production lines halt and municipalities whose services go offline.

Early ransomware simply locked a screen. Today’s operations are professional: criminals research victims, steal sensitive data before encrypting, negotiate through support-style chat portals and, in some cases, operate as “ransomware-as-a-service” where developers rent their malware to affiliates who carry out the intrusions.

How a Ransomware Attack Happens

A typical enterprise attack unfolds over days or weeks rather than minutes:

1. Initial access: a phishing email, a stolen VPN password, an exposed remote desktop service or an unpatched internet-facing server.
2. Foothold and discovery: the intruder explores the network, harvests credentials and identifies valuable systems and backups.
3. Privilege escalation and lateral movement: they obtain administrator rights, often reaching the domain controller.
4. Data theft: sensitive files are copied out to attacker-controlled servers.
5. Backup destruction: shadow copies and connected backups are deleted.
6. Encryption: the ransomware is pushed to many machines at once, often at night or on holidays.
7. Extortion: the ransom note appears; the gang threatens to leak stolen data if payment is refused.

Because the early stages are quiet, monitoring and incident response skills can stop an attack before encryption starts. This is exactly what a SOC does, and what our SOC analyst course trains you for.

Famous Ransomware Incidents

WannaCry (2017) spread worldwide by exploiting a Windows file-sharing flaw that had a patch available, affecting hospitals, telecom firms and manufacturers; it illustrated the cost of delayed patching. NotPetya (2017) looked like ransomware but was largely destructive and caused enormous losses to global companies. Ryuk, Conti and LockBit were among groups known for targeting large organisations with “big game hunting”. Indian organisations, including healthcare institutions and public bodies, have also suffered high-profile attacks in recent years, which is why regulators stress incident reporting and resilience.

Should You Pay the Ransom?

Law-enforcement agencies and security experts generally advise against paying. Payment funds criminals, offers no guarantee of a working key, may expose you to repeat attacks and, in some jurisdictions, can create legal or sanction issues. If your organisation has no usable backups, the decision becomes a difficult business and legal one; involve legal counsel, your cyber insurer if any, and the authorities, and do not negotiate alone. The best approach is to make the question irrelevant by having tested, offline backups and an incident plan.

Ransomware Prevention Checklist

• Back up with the 3-2-1 rule and keep at least one copy offline or immutable; test restores regularly.
• Patch quickly, especially internet-facing systems, VPNs and remote access tools.
• Enable MFA on email, VPN, remote desktop and all admin accounts.
• Limit privileges so that users and service accounts cannot reach everything.
• Segment networks to contain spread.
• Deploy EDR and monitor alerts around the clock.
• Disable macros from the internet and filter attachments.
• Train employees to recognise and report phishing.
• Practise an incident response plan with a tabletop exercise.

What To Do If You Are Hit

1. Isolate affected devices from the network immediately; pull cables or disable Wi-Fi instead of shutting down if you need memory evidence.
2. Do not delete the ransom note or encrypted files; they help identification and investigation.
3. Identify the scope and the entry point with your IT or security team.
4. Check offline backups and prepare a clean rebuild; restore only after eradicating the intruder’s access.
5. Reset all privileged credentials and keys.
6. Report the incident to the authorities: in India, organisations are expected to inform CERT-In within the required timeframe, and individuals can use 1930 and cybercrime.gov.in.
7. Preserve logs and evidence for forensic analysis; see what is digital forensics.
8. Run a post-incident review and fix root causes.

Ransomware Careers and Skills

Ransomware has created demand for incident responders, forensic analysts, malware analysts, threat intelligence researchers and resilience-focused architects. Learners can build these skills step by step: foundations in the cyber security course, investigation skills in the digital forensics course and reverse engineering in the malware analysis course. Organisations can also book awareness and drills through our industry training programs.

Common Misconceptions About Ransomware

• “Paying always restores data.” Decryption can fail or be partial.
• “We are too small to be a target.” Small firms are often hit because they are easier.
• “Backups on the same network are enough.” Attackers target and delete connected backups.
• “Antivirus will stop it.” Modern attacks use legitimate tools and evade detection.
• “It is only an IT problem.” It affects operations, legal, finance and reputation.

Hands-On Exercise: Backup and Restore Drill

Set up a small file server VM with sample documents. Implement a 3-2-1 backup: one local copy, one copy on a separate device and one offline or immutable copy. Delete or corrupt the main data intentionally and restore it, timing the process. Note the recovery time and any problems. Document how you would restore a whole system. Organisations that perform such drills recover far faster in real incidents.

Self-Test

1. What is double extortion? (Encrypting data and also threatening to leak stolen data.)
2. What backup rule is recommended? (3-2-1 with an offline copy.)
3. What should you do first when infected? (Isolate affected systems.)
4. Where do individuals report fraud? (1930 and cybercrime.gov.in.)
5. Which control limits spread? (Network segmentation.)

Illustrative Scenario: A School’s Weekend

A school’s administrator opens an email attachment pretending to be an inspection notice. On Saturday night, ransomware encrypts the file server, including the exam question bank and student records. The school has backups, but they sit on a drive attached to the same server and are encrypted too. Recovery takes weeks and relies on paper records. After the incident the school adopts offline backups, MFA for email and training for staff. The cost of prevention would have been a fraction of the loss.

Practical Tips for Individuals and Small Offices

• Keep one external backup disconnected after each backup run.
• Do not enable macros in documents received by email.
• Keep Windows and applications updated automatically.
• Use a standard user account for daily tasks.
• Know your recovery plan before you need it and store contact numbers offline.

Where to Go Next: Practice and Resources

Foundational topics become easier once you see how they connect. Treat each article as one piece of a map: networks carry data, operating systems run services, applications process input, people make decisions and attackers look for the weakest link among them. Revisit the basics regularly, because later topics such as cloud security and incident response build directly on them.

• Official documentation and RFCs for protocols you use daily.
• OWASP and MITRE ATT&CK websites for structured knowledge.
• Beginner labs on guided learning platforms.
• Government awareness portals for scams and safe practices.
• A study partner with whom you can explain concepts to each other.

More Questions Learners Ask

Do I need to memorise all these terms?

No. Understand the idea behind each term and how it appears in a real incident; vocabulary becomes natural through labs and repetition.

What is the best order to learn security topics?

Start with networking and operating systems, then threats and controls, then hands-on labs, and finally a specialisation.

How can I test whether I really understand a concept?

Try to explain it in two minutes to a non-technical friend and then demonstrate it in a lab.

Are free resources enough for fundamentals?

They are a good start, but structured feedback from a live course helps you avoid gaps.

How often do fundamentals change?

Core principles change slowly, while tools and threats change quickly, so invest more in principles.

Which fundamentals matter most for employers?

Networking, Linux and Windows basics, common attack types and clear communication.

Interview Questions Related to This Topic

Employers often use fundamentals like these to check whether a candidate really understands a topic. Try answering in your own words before reading the model answer.

What happens when you type a URL in a browser?

The browser resolves the domain with DNS, opens a TCP connection, performs a TLS handshake for HTTPS, sends an HTTP request and renders the response. Security professionals add where attacks can occur at each step, such as DNS spoofing or certificate issues.

How do you respond to a ransomware infection?

Isolate affected systems, preserve evidence, identify the strain and entry point, restore from clean backups, reset credentials and report to relevant authorities such as CERT-In. Paying should not be the default plan.

What is zero trust?

Zero trust assumes no user or device is trusted by default; every access request is verified using identity, device health and context, and access is limited to what is necessary.

Terms to Remember

A shared vocabulary makes learning faster. These terms appear repeatedly in classes, labs and interviews:

• Brute force: Trying many passwords or keys automatically until one works; rate limiting and MFA reduce the risk.
• CERT-In: India’s national agency for responding to cyber security incidents, which issues advisories and reporting directions.
• Ransomware: Malware that encrypts files and demands payment for the key; modern variants also steal data first to threaten publication.
• VPN: An encrypted tunnel between a device and a network, used for secure remote access.
• Patch management: The routine of testing and installing software updates that fix known vulnerabilities.
• DDoS: A distributed denial-of-service attack that floods a service with traffic until legitimate users cannot reach it.

Learn This Hands-On: Recommended Courses

Reading builds understanding, but practice builds skill. If this topic interests you, the best next steps are SOC Analyst Course, Digital Forensics Course and Cyber Security Course. Every course includes live labs, and a new batch starts every week. You can try a free demo class first, compare fees or read about the cyber security course in your city.

Related reading: What Is Malware in Cyber Security? Types, Examples and Protection • Types of Cyber Attacks: 15 Common Attacks Explained With Examples • What Is Digital Forensics? Process, Types, Tools and Career in India.