Malware that encrypts files or systems and demands payment for restoration.
Ransomware is malicious software that encrypts victims' files, rendering them inaccessible, then demands payment (typically cryptocurrency) for the decryption key. Modern ransomware operations are highly organised, with criminals conducting reconnaissance, exfiltrating data before encryption, and threatening to publish stolen data if ransoms aren't paid (double extortion). Ransomware enters through phishing emails, compromised credentials, and unpatched vulnerabilities. Recovery often requires rebuilding from backups—paying ransoms is discouraged as it funds criminals and doesn't guarantee data recovery.
Why It Matters
The DSC Perspective:
Ransomware is the most impactful cyber threat facing businesses today. A successful attack can halt operations entirely. Defence requires multiple layers: email security, endpoint protection, patching, backups, and incident response planning.