What Is Ransomware?

Ransomware is malicious software that locks or encrypts a victim’s files or entire systems and then demands a payment, usually in cryptocurrency, in exchange for restoring access. It is one of the most disruptive forms of cyberattack faced by Indian businesses, hospitals, government bodies and ordinary users, and India’s national cyber agency CERT-In treats it as a serious, reportable incident. The core defence is not paying attackers but preparing in advance: tested offline backups, patched software, strong authentication and staff who can recognise the traps that let ransomware in.

What ransomware actually does

At its simplest, ransomware is a type of malware designed to make money by denying you access to your own data. Once it runs on a device, it typically scrambles documents, photos, databases and backups using strong encryption, then displays a ransom note with payment instructions and a deadline. Files usually remain physically present but unreadable without a decryption key held only by the attacker. The encryption used is often the same class of strong cryptography that legitimately protects data, which is precisely why victims cannot simply reverse it without the key.

Modern ransomware rarely stops at encryption. Attackers frequently steal a copy of the data first and threaten to publish or sell it if the victim refuses to pay. Security agencies call this double extortion, and some groups add a third layer, such as launching denial-of-service attacks or contacting a victim’s customers, employees or the media, to increase pressure. This shift means that even organisations with perfect backups can still be coerced, because the threat is no longer only about lost access but about a damaging public leak of confidential information.

Ransomware also differs from ordinary malware in its business logic. It is engineered to be noticed. Where spyware tries to stay hidden, ransomware announces itself loudly once its work is done, because the entire model depends on the victim knowing they have been hit and being pushed toward payment. That visibility is one reason ransomware has become the most talked-about cyber threat facing organisations of every size.

How ransomware gets in

Ransomware does not appear from nowhere. It relies on a small number of well-known entry routes, most of which involve human error or unpatched systems:

• Phishing emails: Malicious attachments or links remain a leading cause. Understanding how phishing works is one of the most effective personal defences.
• Exposed remote access: Weakly protected remote desktop and VPN services are routinely brute-forced or bought from access brokers.
• Unpatched software: Known vulnerabilities in servers, browsers and plugins give attackers a foothold.
• Compromised credentials: Reused or stolen passwords let attackers log in rather than break in.
• Malicious downloads: Cracked software, fake updates and rogue installers can carry hidden payloads.

The typical attack timeline

A ransomware incident is rarely instantaneous. Attackers often spend days or weeks inside a network before triggering encryption. A common sequence looks like this:

1. Initial access through phishing, stolen credentials or an exposed service.
2. Persistence and privilege escalation, where attackers gain administrator rights.
3. Lateral movement across the network to reach servers and backups.
4. Data exfiltration, copying sensitive files for extortion.
5. Encryption, often launched at night or over a weekend for maximum impact.
6. Extortion, with a ransom note and countdown.

This dwell time is also an opportunity: organisations that monitor logs and network activity can detect and stop an attack before the final encryption stage. Warning signs during the intrusion can include unusual login times, the sudden appearance of new administrator accounts, security tools being switched off, and large volumes of data being copied to unfamiliar locations. Recognising these signals early can be the difference between a contained incident and a full-blown crisis.

The real cost of an attack

The ransom demand is only part of the damage. In practice, the largest costs of a ransomware incident usually come from everything around it: the downtime while systems are unavailable, the labour of rebuilding and restoring, lost business and customers, regulatory and legal exposure, and long-term reputational harm. For hospitals, utilities and public bodies, an attack can also endanger essential services, turning a technical failure into a public-safety issue.

These wider costs explain why prevention is so much cheaper than recovery. An organisation that invests in backups, patching and staff training spends a fraction of what it would cost to rebuild trust and operations after a serious breach. The same logic applies to individuals: the inconvenience of maintaining backups is trivial compared with permanently losing family photos or critical documents.

Types of ransomware

Not all ransomware behaves the same way. The table below compares the main categories that security teams encounter.

What CERT-In advises

India’s Computer Emergency Response Team, CERT-In, is the national nodal agency for cyber incidents and has issued repeated guidance on ransomware. Its recommendations centre on prevention and preparedness rather than payment. Key measures highlighted in CERT-In and allied guidance include:

• Maintain regular offline backups and routinely test that data can actually be restored.
• Enforce strong, unique passwords and enable multi-factor authentication on all critical accounts.
• Apply role-based access control so a single compromised account cannot reach everything.
• Keep operating systems and applications patched and up to date.
• Continuously analyse logs for failed logins and unusual configuration changes.
• Move towards a zero trust model, where no user or device is trusted by default.
• Train staff to spot phishing and run periodic cyber drills.

Critically, CERT-In requires that cyber incidents, including ransomware, be reported promptly so that the agency can help contain damage and track wider campaigns. Reporting is a legal and practical duty, not an admission of failure. Prompt reporting also feeds national threat intelligence, helping other potential targets defend themselves against the same attackers and techniques before they strike.

Allied international guidance, such as the joint #StopRansomware guidance produced by agencies including CISA and the FBI, reinforces the same message: prepare in advance, adopt a zero trust architecture, keep offline encrypted backups and rehearse an incident-response plan. The consistency across national and international advice reflects a broad expert consensus on what actually works.

Should victims pay the ransom?

Guidance from CERT-In and international agencies is consistent: paying is discouraged. Payment does not guarantee that files will be restored, does not remove stolen data from criminals’ hands, and funds further attacks. Decryption tools supplied by attackers are often slow or unreliable, and paying can mark an organisation as a soft target for repeat attacks. Instead, the priority is isolating affected systems, preserving evidence, notifying authorities and restoring from clean backups.

If an incident occurs, a calm, staged response matters more than speed alone. A sensible sequence is to:

1. Isolate infected devices from the network to stop the spread, without wiping them.
2. Preserve evidence, including the ransom note and system logs, for investigators.
3. Report the incident to CERT-In and, where relevant, to law enforcement.
4. Assess the scope, identifying what was encrypted and what may have been stolen.
5. Recover from verified clean backups once the environment is secured.

Practical protection for individuals and organisations

Defending against ransomware is largely about layered basics done consistently. For home users and small businesses, the essentials are backups, updates and caution. For larger organisations, the same principles scale up with monitoring, segmentation and rehearsed response plans.

• Back up on the 3-2-1 principle: three copies, on two types of media, with one kept offline or offsite.
• Segment networks so an infection in one area cannot spread everywhere.
• Restrict administrative rights to those who genuinely need them.
• Have an incident response plan that names who does what, and test it.
• Keep security software updated and disable unused remote services.

Because ransomware so often arrives through everyday deception, wider digital-literacy habits matter too. Readers can explore more explainers in our technology section, and understanding related protections such as end-to-end encryption helps put the broader security picture in context.

Why ransomware keeps growing

Ransomware persists because it is profitable, increasingly professionalised and hard to trace. The rise of ransomware-as-a-service has turned attacks into a criminal supply chain, where developers build the tools and affiliates carry out intrusions for a cut of the proceeds. Cryptocurrency makes payments easier to demand and harder to follow. As more essential services move online, the potential for disruption, and therefore the leverage attackers hold, continues to rise.

Regulation and insurance are also reshaping the landscape. Mandatory breach reporting, data-protection rules and the growth of cyber-insurance are pushing organisations to take basic hygiene more seriously, though insurers increasingly require proof of measures like backups and multi-factor authentication before offering cover. This pressure is gradually raising the baseline of defence across sectors.

The encouraging news is that ransomware is preventable to a large degree. The same measures that stop it, patching, backups, strong authentication and vigilance, also protect against most other cyber threats. Treating security as an ongoing discipline rather than a one-time purchase is the single most important mindset shift for individuals and organisations alike. For accountability-focused coverage of technology risks and public-interest issues, see the full range of reporting on newsreverse com.