Ransomware has evolved from a clumsy nuisance into a sophisticated criminal industry. Understanding how it actually works is the first step to not becoming a victim.
Ransomware is malicious software that encrypts a victim's files or locks them out of their systems entirely, then demands payment — almost always in cryptocurrency — in exchange for a decryption key. According to the U.S. Cybersecurity and Infrastructure Security Agency (CISA), ransomware is designed to render files and the systems that depend on them completely unusable until that ransom is paid [1].
That description is accurate but incomplete. Modern ransomware rarely stops at encryption. Before the files get locked, attackers typically spend days inside a network — stealing data, mapping systems, disabling backups, and positioning themselves for maximum damage. The encryption is the finale, not the whole show.
The Numbers Are Hard to Ignore
Ransomware attacks became marginally less frequent in 2023 compared to the prior year, but the financial toll kept climbing. Sophos' annual State of Ransomware survey, conducted with 5,000 IT and cybersecurity leaders across 14 countries, found that average recovery costs (excluding any ransom payment) reached $2.73 million in 2024 — up nearly $1 million from the $1.82 million figure reported the previous year [2]. Average ransom payments climbed 500% year-over-year. Nearly two-thirds of ransom demands were for $1 million or more.
Those numbers reflect something important: the cost of a ransomware incident is not just the ransom. It's lost productivity, incident response fees, forensic investigation, legal exposure, notification costs, and the time it takes to rebuild systems that may have been running for years.
How Ransomware Actually Gets In
Ransomware doesn't typically break through some exotic zero-day vulnerability. The most common entry points are mundane — phishing emails, exposed remote desktop protocol (RDP) services, and unpatched software vulnerabilities. CISA consistently identifies phishing and remote access tools as the leading infection vectors [1].
A convincing phishing email tricks an employee into opening a malicious attachment or clicking a link that installs a dropper or loader — a small piece of malware whose only job is to fetch and install the actual ransomware payload. Exposed RDP ports let attackers log in directly using stolen or brute-forced credentials. Vulnerable software, from VPN appliances to web-facing servers, gives attackers a foothold without any user interaction at all.
Once inside, the clock starts — but the encryption doesn't. Not yet.
What Happens Inside the Network
After gaining initial access, attackers don't rush. Most ransomware operators spend anywhere from several hours to several weeks inside a network before deploying encryption. This dwell time is when the real damage is set up.
The attacker moves laterally — jumping from system to system, escalating privileges, and discovering where the valuable data lives. Domain administrator credentials are a key target. Once an attacker controls Active Directory or its equivalent, they effectively own the network.
Backups are neutralized early. Windows Volume Shadow Copies — the built-in snapshot mechanism that allows file recovery — are routinely deleted before encryption begins. Network-attached backup targets are identified and wiped. This is deliberate: the attacker wants the victim to have no easy way out.
Double Extortion Changed Everything
Traditional ransomware had a simple answer: maintain good offline backups, restore from them, don't pay. Organizations that followed that advice could usually recover without capitulating to the demand.
Ransomware groups noticed this and adapted. Double extortion emerged as the dominant model: attackers steal a copy of sensitive data before triggering encryption, then threaten to publish it on dark web leak sites if the ransom isn't paid. As of 2025, data exfiltration was reported to accompany 96% of ransomware attacks, according to threat intelligence tracking by BlackFog [3].
What this means in practice: a healthcare organization that successfully restores its systems from backup still faces the threat that patient records will be published online. A law firm that recovers its files still faces the prospect of client communications appearing on a public leak site. Backups solve the operational problem. They don't solve the data breach problem.
The Encryption Itself
Modern ransomware uses hybrid cryptography. Files are encrypted with a fast symmetric algorithm — typically AES — using a randomly generated key. That key is then itself encrypted with an asymmetric algorithm (RSA or similar), using a public key provided by the attacker's server. The victim's machine never sees the private key needed to recover files; it stays on attacker-controlled infrastructure.
This design is intentional. It means there is no practical way to brute-force or reverse the encryption without that private key. Even law enforcement agencies that seize ransomware infrastructure sometimes recover decryption keys for past victims, but only when they actually get control of the key management servers.
Single, Double, and Triple Extortion: What's the Difference?
Ransomware extortion models have expanded over the past several years. The table below summarizes what each layer involves for defenders evaluating response options.
| Model | Files Encrypted | Data Stolen & Leak Threat | Additional Pressure | Backups Solve It? |
|---|---|---|---|---|
| Single Extortion | Yes | No | None | Yes — if offline and intact |
| Double Extortion | Yes | Yes — dark web leak site | Countdown timer, sample data published | Partially — recovers systems, not stolen data |
| Triple Extortion | Yes | Yes | DDoS attacks, direct contact with customers or regulators | No — multiple simultaneous threats |
Ransomware as a Service
Ransomware no longer requires technical sophistication to deploy. The criminal ecosystem has industrialized. Ransomware-as-a-Service (RaaS) platforms operate like legitimate software businesses: a core development team builds and maintains the malware, negotiation portals, payment infrastructure, and leak sites. Affiliates — who may have little or no coding ability — license access to the platform, conduct the actual intrusions, and split the ransom proceeds with the developers.
This model dramatically increased the volume of ransomware attacks while insulating the core developers from operational risk. When law enforcement dismantled major groups like LockBit and ALPHV/BlackCat in 2024, affiliates simply migrated to other platforms. The criminal infrastructure proved more resilient than any single group within it.
Who Gets Targeted?
The short answer is: anyone with data worth stealing or systems worth disrupting. But attackers do prioritize. Organizations with deep pockets and high operational sensitivity — hospitals, schools, legal firms, manufacturers — make attractive targets because the cost of downtime is high and the pressure to restore operations quickly is intense. Critical infrastructure (pipelines, water utilities, government agencies) is targeted for similar reasons.
Smaller organizations aren't immune. They're often attacked precisely because their security posture is weaker and their backup practices are inconsistent. A ransomware operator who can automate initial access and run multiple campaigns simultaneously has no reason to skip a mid-sized accounting firm.
What to Do About It: Defensive Priorities
CISA's guidance on ransomware defense has been consistent for years, and the core recommendations hold up well against current attack patterns [1]. The challenge for most organizations isn't understanding the list — it's actually implementing it.
Backups — the most important single control
Offline, encrypted, regularly tested backups remain the most important single investment for ransomware resilience. "Offline" is the critical word. Backups connected to the network — including cloud storage that is continuously synchronized — are accessible to the ransomware and will be encrypted or deleted alongside everything else. The backup has to be genuinely isolated to do its job.
The other thing organizations consistently get wrong is testing. A backup that has never been restored is a backup whose integrity is unknown. Practice restoring from it before a crisis makes it necessary.
Multi-factor authentication
Credential theft is a primary initial access vector. MFA on all remote access services — VPN, email, RDP, cloud consoles — raises the cost of credential-based attacks significantly. It's not a guarantee, but it eliminates the simplest category of intrusion.
Patching and attack surface reduction
Internet-facing services that run unpatched software are an open invitation. Prioritize patching on anything exposed to the internet: VPN appliances, web servers, email gateways, firewall management interfaces. These are the entry points that ransomware actors scan for continuously.
Detection — looking for the right signals
Security teams that wait for an antivirus alert when encryption starts are already too late. The valuable detection window is earlier: during lateral movement, during data staging, and during the deletion of shadow copies. Alerts on mass file renaming, abnormal outbound data transfers, and Volume Shadow Copy deletion commands catch the attack before the damage is done.
Should You Pay?
CISA strongly discourages paying ransoms to criminal actors [1]. Some victims who paid were never provided with working decryption keys. Others received keys that only partially worked. Some were targeted again by the same or affiliated groups shortly after paying. Paying also funds the criminal ecosystem and signals that the victim is willing to pay — making future targeting more likely.
That said, the real-world decision is more complicated than a blanket rule. Organizations with inadequate backups facing the immediate shutdown of life-critical systems face genuinely hard choices. If you're in that position, involve legal counsel and, if possible, an experienced incident response firm before doing anything. Do not negotiate or transfer funds without professional guidance.
What This Means for Defenders
A few things are worth internalizing that don't always appear in standard checklists. First, the encryption itself is rarely the hardest part to address — it's the detection gap that allows attackers to spend days inside a network unobserved that causes most of the damage. Organizations that invest in detection and response capability — not just prevention — have a meaningfully better chance of catching an attack before it fully deploys.
Second, double extortion has permanently changed what "recovery" means. Restoring systems from backup is a technical achievement, but it doesn't resolve a potential regulatory obligation if sensitive data was stolen. Organizations holding personal health information, financial data, or regulated customer records need to treat any ransomware incident as a presumed data breach from the moment it's detected.
Third, the RaaS model means the criminal infrastructure is more resilient than any individual group. Disruptions to major ransomware gangs do matter, but affiliates move quickly. The underlying problem doesn't go away when a single group is dismantled.
Sources & References
- CISA — Ransomware: What It Is and What To Do (official guidance document)
- Sophos — State of Ransomware 2024: Ransom Payments Increase 500%, Recovery Costs Hit $2.73M
- Huntress — Double Extortion Ransomware: The Threat Backups Cannot Solve
- Vectra AI — Double Extortion Ransomware Explained: Complete Defense Guide (2025)
- CSO Online — Ransomware Explained: How It Works and How to Remove It