What is ransomware? How it works, the stages of an attack, and how to stop it

What ransomware is

Ransomware is a type of malicious software, malware, that takes something you need and holds it hostage until you pay. In the most common form, it encrypts your files, scrambling them so they are unreadable, and demands a ransom, usually in cryptocurrency, in exchange for the key to unlock them. The name is literal: it is software that ransoms your own data back to you.

What makes ransomware so damaging is not the encryption technology itself, which is ordinary, but what it targets. When it hits a hospital, it does not just lock spreadsheets; it can take down the electronic health record, imaging systems, and the tools clinicians rely on to treat patients safely. The disruption, not the encryption, is the real weapon, and it is why ransomware has become the defining threat to healthcare and critical services.

How a ransomware attack actually unfolds

The biggest misconception about ransomware is that it strikes instantly, like a virus from a bad download. In reality, a modern attack is a campaign that plays out over days or weeks, and the encryption everyone pictures is the final act. Understanding the stages is the key to understanding how to stop it.

• Initial access: the attacker gets in, usually through a phishing email, a stolen password, or an exposed remote-access service, not through dramatic hacking.
• Establish and explore: they quietly settle in, map the network, and look for valuable systems and data, trying hard not to be noticed.
• Escalate and move: they steal more credentials, gain administrator rights, and move laterally from machine to machine toward the systems that matter most.
• Steal data: in almost every modern attack, they copy sensitive data out before encrypting anything, setting up the second form of extortion.
• Disable defenses: they turn off or evade security tools and, critically, find and destroy backups so you cannot simply restore.
• Encrypt and demand: only now do they trigger the encryption across the network, lock you out, and leave a ransom note.

Double extortion, and why it changed everything

Early ransomware had a simple logic: encrypt your files, and if you had good backups, you could restore and refuse to pay. Attackers adapted. Today the dominant model is double extortion: they steal a copy of your data before encrypting it, then threaten to publish it on a leak site if you do not pay, even if you can recover from backups. Now you face two threats at once, downtime and a data breach, and good backups alone no longer let you walk away cleanly.

Some groups push further into triple extortion, adding threats to notify your customers or regulators, or to launch denial-of-service attacks, to increase the pressure. The lesson for defenders is that stopping the theft of data, not just the encryption, now matters as much as being able to recover, because the leak threat survives even a perfect restore.

The main types you will hear about

Ransomware is often discussed by family or model rather than by a strict taxonomy, but a few distinctions are useful.

• Crypto ransomware: the common form that encrypts your files and demands payment for the key.
• Locker ransomware: locks you out of the whole device or system rather than encrypting individual files.
• Double and triple extortion: adds data theft, and sometimes further threats, on top of encryption.
• Ransomware-as-a-service (RaaS): a business model where developers rent their ransomware to affiliates, which is why so many groups and attacks exist today.

How organizations defend against ransomware

Because an attack unfolds in stages, defense works best when it addresses more than one of them, not just the final encryption. A strong posture combines three things, and no single product does all three well.

Prevention reduces the chance of initial access and early movement: patching, strong authentication, email filtering, and locking down remote access. It is necessary, but no prevention is perfect, so it cannot be the whole plan. Containment limits the damage once an attacker is inside: detecting the quiet mid-stage activity, lateral movement, credential abuse, data being staged, and isolating the threat before it can spread or finish encrypting. And recovery determines whether an attack that succeeds is a crisis or an inconvenience: the ability to restore clean systems from backups an attacker could not reach, so you never have to weigh paying.

Why recovery is the deciding capability

If there is one lesson from the largest ransomware incidents, it is that recovery is what separates the organizations that come through intact from the ones that pay or collapse. Attackers go after backups first precisely because they know that a victim who can restore has no reason to pay. That is why the strongest defense keeps backups verified, immutable, and air-gapped, out of the attacker's reach, so recovery is always an option.

This is the heart of how we approach the problem. We focus on resilience: detecting an attack in its quiet early stages, containing it automatically before it can spread or finish, and self-healing systems from immutable backups so an attack becomes a contained incident rather than a shutdown. To go deeper, see our explainer on how to know if you have ransomware for the warning signs, our guide to immutable backups for the recovery side, and our pillar on why EDR alone is not enough for where traditional tools leave gaps. Ransomware is beatable, but only by a defense built for how the attack actually works.