Ransomware and Cryptolockers

Ransomware is malware that denies access to data or systems and demands payment — typically in cryptocurrency — for restoration. The defining characteristic is extortion: the victim's own data becomes leverage against them. Modern ransomware operations are sophisticated criminal enterprises generating billions of dollars annually. The 2021 Colonial Pipeline attack disrupted fuel supply across the US East Coast; the 2020 Universal Health Services attack impacted 400 hospitals. Ransomware is among the most severe threats organizations face today, combining technical sophistication with significant business impact.

Ransomware attacks follow a predictable sequence. Initial access: phishing email, RDP brute-force, or exploitation of a public-facing vulnerability. Persistence: install backdoor and disable security tools. Lateral movement: spread through the network to maximize infection scope and compromise backup systems. Data exfiltration: steal sensitive data before encrypting (double extortion). Encryption: encrypt files across all accessible systems simultaneously. Ransom demand: leave ransom note with payment instructions and threat to publish stolen data if unpaid. Understanding each phase reveals defensive opportunities at every step.