What Is Ransomware? How It Works and How to Protect Yourself

Ransomware is the fastest-growing category of cybercrime — and the most expensive. This guide explains what ransomware is, how attacks unfold, the most infamous strains, and the steps that actually protect you.

What Is Ransomware?

Ransomware is a type of malware that encrypts the victim's files and then demands payment — usually in cryptocurrency — in exchange for the decryption key. The name is a literal mash-up of 'ransom' and 'software'.

It is now the fastest-growing category of cybercrime in the world. Industry trackers report that the average ransom demand against businesses crossed $2.73 million in 2025, with total downtime costs running several multiples of that.

How Ransomware Attacks Work

1. Attacker delivers the ransomware via email attachment, malicious download, or unpatched exploit
2. The ransomware installs silently and waits, often for days, to map the environment
3. It scans local and network drives for valuable files and backups
4. Encryption begins — files become inaccessible and often renamed with new extensions
5. A ransom note appears on screen and inside affected directories
6. The attacker demands a cryptocurrency payment in exchange for a decryption key
7. If paid, the decryption tool may be sent — or it may not. There is no guarantee.

Types of Ransomware

• Crypto ransomware — encrypts files. WannaCry, CryptoLocker.
• Locker ransomware — locks the entire device. The old 'Police Trojan' family.
• Double extortion — encrypts files AND threatens to publish them. REvil, LockBit.
• Ransomware-as-a-Service (RaaS) — sold or rented to other criminals. DarkSide.
• Mobile ransomware — targets smartphones, common on Android. Simplocker family.

Famous Ransomware Attacks

WannaCry (2017)

Spread to over 230,000 computers across 150 countries in a single weekend, exploiting the EternalBlue SMB vulnerability.

NotPetya (2017)

Disguised as ransomware but designed for pure destruction. Caused over $10 billion in damages globally.

Colonial Pipeline (2021)

A single ransomware attack shut down the largest fuel pipeline on the US East Coast and triggered nationwide gasoline shortages.

LockBit (2022-2024)

Became the largest ransomware-as-a-service operation in history before law enforcement disrupted parts of its infrastructure.

How to Protect Against Ransomware

• Critical: keep operating system and software fully updated
• Critical: back up data regularly using the 3-2-1 rule
• Critical: never click unexpected email attachments or links
• Important: use reputable antivirus with a ransomware shield
• Important: use strong, unique passwords on every account
• Important: enable 2FA on all important accounts
• Recommended: monitor your IP for blacklist appearances and unusual outbound traffic

The 3-2-1 Backup Rule

Keep at least 3 copies of your important data, on 2 different storage media (for example an internal drive and an external drive), with 1 copy stored off-site or in the cloud. Done correctly, the 3-2-1 rule means a ransomware infection becomes an annoying restore job rather than a catastrophe.

Should You Pay the Ransom?

The FBI, the UK's NCSC, and most national cyber agencies all recommend NOT paying. Payment funds the next wave of attacks, marks you as a willing target, and provides no guarantee that you will actually receive a working decryption key.

If your backups are sound, you almost never need to pay. If they are not, that itself is the lesson — and the next backup policy you implement should follow the 3-2-1 rule above.