What Is Ransomware? How It Works and How to Survive It (2026)
Of all the ways a computer can be hit, ransomware is the one that strikes hardest and fastest. One moment your files are fine. The next, they’re scrambled, and a note demands payment. It is a multi-billion-dollar criminal industry. It targets individuals just as readily as hospitals. This guide explains what ransomware is and how an attack unfolds. It also covers why paying is a trap, and the single defence that truly works.
Ransomware is often distributed through the same infrastructure as what a botnet is, so understanding both gives you a fuller picture of modern malware.
What ransomware is
Ransomware is a type of malware that encrypts your files - documents, photos, whole drives. It then demands a ransom for the decryption key, usually in cryptocurrency. Some variants steal a copy of your data first. They threaten to leak it (“double extortion”) to push you harder.
The cruelty of it is simple. It does not need to break your encryption or steal your identity. It just locks you out of your own data. Then it charges you to get back in.
How an attack unfolds
- Entry - usually via phishing (a bad attachment or link), a tainted download, or an unpatched service exposed to the internet.
- Execution & spread - the malware runs. It often raises its privileges quietly and spreads across drives and network shares.
- Encryption - it encrypts your files with a key only the attacker holds. Then it drops a ransom note.
- Extortion - pay in crypto for the key, or lose the data. With double extortion, you risk a leak too.
The whole sequence can finish in minutes. That is faster than you can react.
Why paying is a bad bet
Paying funds the criminal industry. It marks you as someone who pays, which invites repeat attacks. And it guarantees nothing. Decryptors are sometimes broken or never sent. Data already stolen can still be leaked. Law-enforcement guidance is consistent: avoid paying, and report the incident. The only reliable recovery is restoring from a clean backup.
The one defence that works: backups it can’t reach
You can lower the chance of infection. Patch everything, don’t run unknown files, use least privilege, and stay wary of email. But only one thing lets you recover: a backup ransomware can’t encrypt.
- Follow the 3-2-1 rule: 3 copies, on 2 types of media, 1 kept offsite/offline.
- An offline or immutable backup is key. Ransomware encrypts everything it can write to. So a drive left plugged in, or a cloud kept always mounted, can be hit too.
- Test that you can actually restore.
Isolation reduces the blast radius
Security-focused systems limit how far ransomware can spread. Some split apps into separate boxes, as Qubes OS does. Others run sensitive work on an amnesiac system like Tails. Either way, a compromise in one place can’t reach everything. Full-disk encryption protects data at rest from theft. But note it does not stop ransomware. Your unlocked, running system can still be encrypted on top.
For a fuller picture of how these threats differ, see what malware is and the related spyware and keylogger guides.
The bottom line
Ransomware is malware that encrypts your files and demands payment. It is fast, lucrative, and indiscriminate. Don’t count on prevention alone, and don’t pay. The only dependable recovery is a backup it can’t reach, kept offline or immutable under the 3-2-1 rule. Lower the odds with patching, least privilege and phishing awareness. Limit spread with isolation. But the backup is what saves you.
Editorial guide based on how ransomware works (encryption-for-ransom, double extortion) and standard defence (3-2-1 backups, offline/immutable copies, isolation). The commercial link carries the rel=“sponsored nofollow” attribute; an affiliate commission may apply at no extra cost to you.
Frequently asked questions
What is ransomware?
Ransomware is malware that encrypts your files, or locks your device. It then demands a payment to restore access, usually in cryptocurrency. Modern variants often steal data too and threaten to publish it (“double extortion”). It spreads via phishing, malicious downloads and exploited vulnerabilities.
Should I pay the ransom?
Security authorities generally advise against paying. There is no guarantee you get your data back. It funds and encourages more attacks, and you may be targeted again. The reliable recovery path is restoring from clean, offline backups. Paying should be a last resort, considered only with professional and legal guidance.
How do I protect against ransomware?
The strongest defence is backups. Keep regular, versioned, offline or immutable copies so you can restore without paying. Add patching of known vulnerabilities, phishing-aware habits, least-privilege accounts, and reputable protection. Test that your backups actually restore. An untested backup is not a backup.