Ransomware
noun · MITRE ATT&CK T1486
Malware that encrypts an organization's data and demands payment for the key, often after stealing the data to threaten its release.
Ransomware encrypts files and systems and demands payment, usually in cryptocurrency, in exchange for the decryption key. Modern ransomware operations rarely stop there. In double extortion, the attackers first copy sensitive data out of the network and then threaten to publish it if the ransom is not paid, so restoring from backups no longer solves the whole problem.
Many attacks are run as ransomware as a service (RaaS): one group develops the malware and the payment infrastructure, while "affiliates" break into victims and share the profits. The encryption is the last step of a longer intrusion that usually involves stolen credentials, privilege escalation and lateral movement over days or weeks.
Example
Attackers log in through a VPN account without MFA, spend a week mapping the network, steal a domain administrator's credentials, copy several hundred gigabytes of files to a cloud storage service, delete backups and shadow copies, and finally deploy the encryptor to every server at once on a Friday night.
Why it matters for a SOC analyst
By the time files are encrypted, the incident is already severe. The earlier stages are where you can stop it: a new remote access tool, credential dumping, large outbound transfers, or commands such as vssadmin delete shadows that remove recovery options. CISA's #StopRansomware guidance is a good checklist for both prevention and response.
Related terms
- Malware
Any software designed to harm a system or its users, such as viruses, worms, trojans, ransomware, spyware and infostealers.
- Worm
Malware that copies itself from system to system on its own, usually by exploiting a vulnerability, without any user action.
- Privilege escalation
Gaining higher permissions than an account was given, such as moving from a standard user to local administrator, domain admin or cloud global admin.
- Lateral movement
The techniques attackers use to move from the first compromised system to other systems and accounts inside a network.
- Incident response
The organized process of detecting, analyzing, containing, eradicating and recovering from a security incident, then learning from it.