What Is Ransomware

Ransomware is malware that encrypts the files on an infected computer and demands a ransom in exchange for decryption. The ransom is usually demanded in cryptocurrency such as Bitcoin, which is hard to trace.

Ransomware in the 2020s goes beyond simply encrypting files: combining it with "double extortion" has become common. In addition to encrypting the data, the attackers steal it and threaten to publish it unless the ransom is paid. "Triple extortion", in which the victim's business partners and customers are also contacted to increase the pressure, and extortion without any encryption, where the threat of publishing the stolen data is the only leverage, have also been observed.

The attacker side has become specialized. In the "RaaS (Ransomware as a Service)" model, the party that provides the ransomware itself and the attack infrastructure is separate from the party that actually breaks into an organization and deploys it. Because attackers who cannot build their own tools can take part as well, the pool of people carrying out attacks grows.

In the IPA's "10 Major Security Threats 2026" (published in January 2026), "damage caused by ransom attacks" is ranked first among the threats to organizations, and it has been selected in the organization category for 11 consecutive years.

Major Infection Vectors

Phishing emails: A leading infection vector. The target is induced to open an attachment disguised as an invoice or a delivery notice (an Office file containing macros, or an executable inside a ZIP archive). Since Office macros began to be blocked by default, the abuse of OneNote files and ISO images has also been observed.
Vulnerabilities in VPN appliances: Attackers break in through unpatched VPN appliances or Remote Desktop (RDP) vulnerabilities. Japan's National Police Agency states that the abuse of VPN appliances and similar equipment exposed to the internet is the main intrusion route.
Supply chain attacks: The infection is spread to a large number of organizations at once through a software update mechanism or a managed service provider (MSP). In the Kaseya incident of July 2021, the company announced that between 800 and 1,500 downstream businesses were affected.
Social engineering: Attackers pose as IT support over the phone or in chat and guide the target into installing a remote access tool. This exploits human psychology rather than a technical vulnerability.

Effective Prevention Strategies

Preventing ransomware damage requires a multi-layered approach.

Practice the 3-2-1 Backup Rule: Keep 3 copies of data on 2 different media types with 1 copy offsite. Since ransomware also encrypts network-accessible backups, offline backups (air-gapped) are essential.
Prompt Patch Management: Apply security patches for OS, VPN appliances, and applications as quickly as possible. Prioritize patches for vulnerabilities with known exploits.
Network Segmentation: Divide the network into segments to contain the spread if one segment is compromised. Isolate critical systems and backup servers in separate segments.
Endpoint Detection and Response (EDR): Deploy EDR solutions that detect suspicious behavior (mass file encryption, shadow copy deletion) and automatically isolate affected endpoints.
Email Security: Implement email filtering to block malicious attachments and URLs. Sandbox analysis of attachments adds another layer of protection.

Incident Response Steps

If a device is infected with ransomware, do not panic and work through the following steps.

Disconnect from the network immediately: Unplug the LAN cable of the infected device and disable Wi-Fi. This is the highest priority action for preventing lateral spread.
Do not pay the ransom: There is no guarantee that a decryption key will be provided even if you pay, and the payment becomes a source of funds for the attackers that encourages the next attack. Law enforcement agencies in various countries also urge victims not to give in to the demand.
Preserve the evidence: Save a screenshot of the ransom demand screen, samples of the encrypted files, and the log files.
Contact an incident response team: Contact your internal CSIRT or a security vendor and get support from specialists. Individuals should consult the cybercrime helpdesk of the police.
Check for a decryption tool: Check No More Ransom (nomoreransom.org), operated by Europol and its partners, to see whether a free decryption tool for that ransomware has been published.

Recovery after an infection can take weeks or even months. Preparation made in advance (backups and a response plan) decisively determines how large the damage becomes.

Common Misconceptions

Ransomware only targets large enterprises: Small and medium businesses and individuals are frequently targeted. SMBs with limited security measures are actually preferred as "easy targets." Numerous incidents involving hospitals, municipalities, and small manufacturers have been reported.
Paying the ransom guarantees data recovery: Cases have been reported where the decryption key was not provided after payment, decryption failed, or only some files were recovered. Organizations that pay once tend to be re-targeted as "proven payers."

Ransomware