Also known as: crypto-ransomware · ransomware attack
Ransomware is malicious software that denies an organisation access to its own data — historically by encrypting it — and demands payment in exchange for restoring access or withholding publication of stolen data.
The model has evolved through distinct phases. Early ransomware simply encrypted files locally. Double extortion added data theft before encryption, so that reliable backups no longer removed the leverage. More recently, some groups have dropped encryption entirely, stealing data and threatening publication alone.
That last shift matters operationally: detection tooling built to catch mass file encryption is blind to extortion-only intrusions, and recovery-time objectives built around restoring from backup are irrelevant when nothing was ever encrypted. The crisis becomes legal and reputational rather than technical.
Double Extortion
Double extortion is a ransomware tactic in which attackers steal a copy of an organisation's data before encrypting it, so that refusing to pay risks both operational disruption and public release of the stolen information.
Ransomware-as-a-Service
Ransomware-as-a-service (RaaS) is a criminal business model in which ransomware developers lease their malware and infrastructure to affiliates, who carry out the actual intrusions and share a percentage of ransom proceeds with the operators.
Backup and Recovery
Backup and recovery is the practice of maintaining recoverable copies of data and systems, and verifying that restoration actually works, so that an organisation can recover from destruction, corruption, or ransomware.
Incident Response
Incident response is the structured process an organisation follows to detect, contain, eradicate, and recover from a security incident, and to learn from it afterwards.
Malware
Malware is any software written to cause harm to a system, network, or user, including viruses, worms, trojans, rootkits, spyware, and ransomware.