What is ransomware?

Ransomware: definition and sequence of events

The term combines “ransom” and “software.” The malware encrypts files, servers and often the backups too, and displays a ransom demand, usually with payment in cryptocurrency. Without the key, the data is useless and operations come to a standstill: no orders, no invoices, no access to customer data.

Modern attacks are rarely random hits. The perpetrators break in, gain admin rights, explore the network, copy data and only encrypt after days or weeks. In this double extortion, they additionally threaten to publish the data. Many groups offer their tools as “ransomware-as-a-service.”

Typical entry points

Attacks usually do not rely on high-tech tricks but on known weaknesses in everyday operations: a careless employee decision, a forgotten access rule, an update that was not installed. The more of these gaps a company closes, the more costly and risky the attack becomes for the perpetrators, and the sooner they look for an easier victim.

• Phishing emails with attachments or links
• Remote access such as RDP reachable from the internet without a second factor
• Security updates not installed on VPN gateway, firewall and servers
• Stolen or reused passwords
• Access for service providers or partners that is never reviewed

Real-world example: the encrypted file server

At a supplier with 80 employees, no design drawings can be opened on Monday morning; all files carry a new extension, and a ransom demand sits on the desktop. The backup was attached to the same network as a drive and was encrypted along with everything else. Operations stand still, delivery deadlines are at risk, and customers ask when things will resume. It is also unclear whether data has been exfiltrated.

With preparation, the sequence would look different: affected devices are disconnected from the network, management and a specialist service provider are informed, the police file a report, and the systems are rebuilt from a separately stored backup. It takes time, but operations resume without any ransom being paid.

Prevention and what to do in an emergency

The most important precaution is backups following the 3-2-1 rule, with at least one copy stored offline or immutable, plus regular restore tests. In addition come timely updates, multi-factor sign-in, separated networks, endpoint protection with EDR and an emergency plan that sets out who does what and when. Authorities such as the BSI advise against paying ransom: decryption is not guaranteed, and every payment finances further attacks.

Nano Concepts reviews your backup concept and attack surface, sets up protective measures such as segmentation, updates and endpoint protection, and supports an orderly restart after an incident. A documented emergency plan with contacts and a restart sequence saves valuable hours in an emergency and prevents hasty wrong decisions.