CyberGlossary

Malware

Ransomware

Also known as: Crypto-ransomware, Cryptolocker malware

Definition

Malware that encrypts a victim's data or locks systems and demands payment in exchange for restoring access.

Ransomware encrypts files, databases, virtual machines or whole storage volumes and then displays a note demanding cryptocurrency in exchange for the decryption key. Modern operators usually run "double-extortion" campaigns: they steal data before encryption and threaten to publish it on leak sites if the victim refuses to pay. Initial access is typically gained through phishing, exposed RDP/VPN portals, software vulnerabilities, or compromised credentials. Effective defences include offline and immutable backups, EDR/XDR, MFA on remote access, rapid patching, network segmentation, and a tested incident response plan. Paying does not guarantee recovery and may fund further attacks.

Examples

  • WannaCry (2017), which spread via the EternalBlue SMB exploit.
  • LockBit and Conti, ransomware-as-a-service operations behind many enterprise breaches.

Related terms