Guides Threats
Ransomware: how it works, and what to do
The one category where what you did beforehand matters far more than anything you can do afterwards.
What actually happens
Access is gained - commonly through an attachment, a stolen or reused credential, or an unpatched service reachable from the internet. There is often a quiet period first, while the attacker looks around, works out where the valuable files are, and locates the backups.
Then encryption runs, usually fast and usually outside working hours. Modern operations typically copy data out before encrypting it, so that refusing to pay carries a second threat: publication.
In the first hour
- Disconnect the affected machine from the network - unplug the cable, switch off Wi-Fi. Do not power it down if you can avoid it, as some evidence exists only in memory.
- Disconnect external drives and unmount network shares that are not yet affected.
- Do not delete the ransom note or the encrypted files. Both may be needed to identify the variant.
- Photograph the ransom screen. It is the fastest way to record what you are dealing with.
- Check whether a free decryptor exists for that variant before considering anything else. Some have been published by researchers and law enforcement.
About paying
Paying is a business decision with poor guarantees. There is no assurance the key works, that all files recover, that stolen data is deleted, or that the same group does not return. In some jurisdictions payments may also raise legal questions depending on who ultimately receives the money.
For an individual with intact backups, the answer is almost always to restore. For an organisation, this is a decision for management with legal advice, not one to be taken at the keyboard at two in the morning.
Restoring safely
Rebuild the machine rather than cleaning it. Restoring files onto a system that may still be compromised invites a repeat. Change passwords for accounts used on that machine, from a different device, and only then restore data.
What actually prevents it
Backups that ransomware cannot reach are the core of it: offline, or on storage that does not permit deletion or overwriting for a set period. A backup drive left permanently connected gets encrypted along with everything else.
After that: multi-factor authentication on remote access, prompt patching of anything internet-facing, and behaviour-based protection, which catches encryption activity even when the specific file is new.