How Ransomware Works

Ransomware is malware that denies access to data or systems, typically by encrypting files, then demands payment for restoration. Modern campaigns are run by organized criminal enterprises with affiliates, support desks, and negotiation playbooks.

Understanding the mechanics defensively, not to build it, lets you break the attack chain at multiple points.

Ransomware rarely encrypts the instant it lands. It follows a chain you can interrupt:

• Initial access — phishing, exposed RDP, vulnerable VPN
• Foothold and persistence — backdoor, scheduled task
• Privilege escalation and lateral movement — spreading to more hosts
• Discovery and exfiltration — finding and stealing data
• Impact — mass encryption and ransom note

Detection during the early dwell time is far cheaper than recovery after encryption.

Most intrusions start with a small number of predictable entry points:

• Phishing with malicious attachments or links
• Exposed remote services like RDP with weak or reused passwords
• Unpatched internet-facing software (VPN, mail, web apps)
• Valid credentials bought from access brokers

Closing these is the highest-leverage prevention, covered in the next lesson.

Modern ransomware uses hybrid cryptography. It generates a fast symmetric key (AES) per file or per host to encrypt data quickly, then encrypts that symmetric key with the attacker's public key (RSA or elliptic curve).

Only the attacker holds the matching private key, so victims cannot recover the symmetric keys without it. Poorly built strains sometimes reuse or leak keys, which is why decryptors occasionally exist, but you should never rely on that.

Sophisticated operators know backups are your escape route, so they hunt them before encrypting.

• Deleting or encrypting backup repositories
• Deleting Windows Volume Shadow Copies
• Targeting backup admin credentials

This is why immutable, offline, or air-gapped backups (next lesson) are decisive: they cannot be reached and destroyed even with domain admin.

Encryption alone fails against good backups, so attackers escalated leverage.

• Single extortion — encrypt and demand payment for the decryption key
• Double extortion — also exfiltrate data first, then threaten to publish it

Double extortion means restoring from backup is no longer enough: the data breach already happened. Treat every ransomware case as a potential data breach with legal and notification obligations.

Beyond encryption and leaks, crews add pressure to force fast payment:

• Triple extortion — threatening the victim's customers or partners directly
• DDoS against the victim during negotiation
• Contacting media or regulators to amplify reputational damage

These tactics target the business, not just the systems, which is why response must involve legal, communications, and leadership, not only IT.

The ecosystem is industrialized. RaaS operators build and maintain the malware and leak site, then rent it to affiliates who carry out intrusions and split the profit.

Implications for defenders:

• Many different intruders use the same toolkit, so shared indicators help
• Affiliates have varying skill; some are noisy and detectable
• Disrupting one operator displaces but does not eliminate the threat

Payment is not a clean fix and is sometimes legally restricted.

• No guarantee the decryptor works or is provided at all
• Decryptors are often slow or corrupt files
• Stolen data may be leaked or resold anyway
• Paying funds future attacks and may violate sanctions law
• Marks you as a payer, inviting repeat targeting

The defensible position is to be able to recover without paying, through preparation.

To evade detection, operators abuse legitimate built-in tools rather than dropping obvious malware. This is living-off-the-land.

• Native admin tools for remote execution and discovery
• Legitimate remote-access software repurposed for control
• Built-in scripting to disable defenses and spread

Because the binaries are trusted, detection shifts from signatures to behavior: unusual use of admin tools by unexpected accounts.

Every stage offers a defensive opportunity:

• Initial access — MFA, patching, phishing resistance
• Lateral movement — segmentation, least privilege
• Exfiltration — egress monitoring, DLP
• Impact — immutable backups so encryption cannot be permanent

You do not need to win every stage; interrupting any one can stop the operation. The next lessons build these layers.

Apply the lifecycle to a recovery decision.

You now understand the mechanics well enough to defend against them.

• Ransomware follows a lifecycle: access, persistence, lateral movement, exfiltration, then impact
• It uses hybrid encryption and deliberately destroys backups first
• Double and triple extortion add data leaks and external pressure, making it a breach too
• RaaS industrializes attacks; living-off-the-land evades signatures
• Paying is risky; the goal is recovery without paying

Next: preventing the attack from ever taking hold.