Skip to content
Knowledge Hub/Article
Article

What Is Ransomware? How Attacks Work and How to Prevent Them

Learn the stages of a ransomware attack, double extortion, the RaaS model, CISA's prevention advice and what to do in the first hours of an attack.

Oğuzhan Gerçek··9 min read
What Is Ransomware? How Attacks Work and How to Prevent Them

Short answer: Ransomware is malware that makes files or devices unusable, by encrypting files or locking devices, and then demands payment to restore access. Attackers may also exfiltrate the data and threaten to publish it if the victim does not pay; this is known as double extortion. Encryption is one of the last stages of an attack: initial access, privilege escalation, lateral movement and the targeting of backups come first. The core defenses are tested backups that attackers cannot reach, phishing-resistant MFA, fast patching, network segmentation, EDR and an incident response plan that has been exercised.

What is ransomware?

CISA's #StopRansomware Guide (September 2023) defines ransomware as a form of malware designed to encrypt files on a device, rendering them and the systems that rely on them unusable; the attackers then demand a ransom in exchange for decryption. NIST's IR 8374 Rev. 1 profile, published in June 2026, adds that attackers may also steal an organization's information and demand an additional payment for not disclosing it to authorities, competitors or the public. Ransomware is a type of malware; you will find a short definition in our glossary.

Microsoft distinguishes two kinds. Commodity ransomware spreads like a virus. In human-operated ransomware, by contrast, attackers infiltrate the infrastructure, elevate their privileges and deploy the ransomware themselves to the systems that hold critical data.

How does a ransomware attack unfold?

According to Microsoft's analysis of RaaS, focusing solely on the ransomware stage obscures the many stages of the attack that come before it. Mapped to MITRE ATT&CK tactics, a typical attack follows roughly this sequence:

  1. Initial access: The attacker gets into the network. According to NIST, ransomware attacks often start with credential compromise.
  2. Privilege escalation: The attacker tries to gain higher-level permissions.
  3. Lateral movement: They move from system to system inside the network.
  4. Targeting backups: According to CISA, many ransomware variants try to find and then delete or encrypt accessible backups, so that restoration is impossible unless the ransom is paid (T1490).
  5. Exfiltration: Data is moved out of the organization.
  6. Encryption: Data on local and remote drives is encrypted, and the attacker withholds the decryption key (T1486).
  7. Extortion: A ransom note arrives, along with a threat to publish the stolen data if the victim does not pay.

According to CISA, a ransomware event may be evidence of a previous, unresolved network compromise.

What is double extortion?

According to CISA, attackers have over time also exfiltrated victim data and pressured victims to pay by threatening to release it. Using encryption and this threat together is known as double extortion. In some cases, attackers do not deploy ransomware at all, and the stolen data is their only leverage.

The ENISA Threat Landscape 2026 writes that its 2025 data is likely to confirm a broader shift from encryption-based activity toward data exfiltration and extortion-focused operations; operators kept up the pressure through public claims on data leak sites. Restoring from backup undoes the encryption, but it does not bring leaked data back.

What is Ransomware-as-a-Service (RaaS)?

In Microsoft's description, RaaS is an arrangement between an operator and an affiliate. The operator develops and maintains the tools behind the operation, including the builders that produce the payloads and the payment portals used to communicate with victims; the affiliate performs the intrusion and privilege escalation and deploys the payload. Access brokers, meanwhile, infect systems with malware or a botnet and then sell that access. According to Microsoft, affiliates using the same payload can have wildly different tradecraft.

The Medusa advisory issued by the FBI, CISA and MS-ISAC in March 2025 offers a concrete example. First identified in June 2021, this RaaS variant later moved to an affiliate model, recruits initial access brokers on cybercriminal forums and uses double extortion. As of February 2025, it had more than 300 victims.

Initial access and prevalence

According to Verizon's 2026 Data Breach Investigations Report (DBIR), which examined more than 22,000 confirmed breaches between November 1, 2024, and October 31, 2025, ransomware was present in 48% of breaches, up from 44% the year before. The report's executive summary notes that small organizations are disproportionately affected. Pretexting has also become a more common initial access vector for ransomware and extortion attacks; we explain the technique in our social engineering article. According to ENISA, ransomware accounted for 47.3% of financially motivated activity in 2025, and operators exploited vulnerabilities in VPN and firewall appliances.

CISA's guide groups the initial access vectors under five headings:

  • Internet-facing vulnerabilities and misconfigurations
  • Compromised credentials
  • Phishing (see our phishing article for how to spot it)
  • Precursor malware: many ransomware infections are the result of existing malware such as QakBot, Bumblebee or Emotet
  • Third parties and managed service providers

How to protect against ransomware

These are the standout items on CISA's prevention list:

  • Offline backups: Keep offline, encrypted backups of critical data and test them regularly in a disaster recovery scenario. NIST IR 8374 Rev. 1 also recommends storing data in an immutable format. The 3-2-1 rule is covered in our backup article, and there is a short definition in our glossary.
  • Phishing-resistant MFA: For all services, particularly email, VPNs and accounts that access critical systems. We compare the methods in our MFA article; why VPNs are a target is the subject of our VPN article.
  • Patching: Timely patching of internet-facing servers, especially for known exploited vulnerabilities; the process is in our patch management article. Services such as remote desktop protocol (RDP) should not be exposed on the web.
  • Segmentation: According to CISA, it helps contain the impact of an intrusion and prevent or limit lateral movement. We cover the layers in our network security article.
  • EDR and application allowlisting: Only authorized software should run on any asset; the differences are explained in our endpoint security article.
  • Least privilege: Microsoft lists protecting privileged roles as a priority, and ATT&CK recommends limiting the accounts that can access backups (M1018). We explain the access model in our IAM article.
  • Incident response plan: Create a plan with response and notification procedures for ransomware and data extortion, and exercise it regularly. CISA also asks for a hard copy and an offline version of the plan.

First steps during an attack

These are the steps from CISA's response checklist that matter in the first hours:

  1. Determine which systems were impacted and isolate them immediately; if several systems are affected, take the network offline at the switch level.
  2. Power down devices only if you cannot disconnect them from the network, because powering down destroys the evidence held in memory.
  3. Take a system image and memory capture of a sample of affected devices, and collect logs and samples of any precursor malware.
  4. Identify the systems and accounts involved in the initial breach. Find any dropper malware before rebuilding from backups; otherwise the compromise continues.
  5. Report the incident. In Türkiye, those covered by Cybersecurity Law No. 7545 must report the cyber incidents they detect to the Cybersecurity Presidency without delay (Article 7); see our Cybersecurity Law article for details.

We explain how to choose the recovery point and the order of recovery in our ransomware recovery playbook. We handle backup operations on our Backup, Replication & Recovery page, disaster recovery on our Disaster Recovery & Continuity Engineering page and 24/7 detection on our security operations page.

Should you pay the ransom?

In their joint advisories, the FBI, CISA and MS-ISAC do not encourage paying ransoms: payment does not guarantee that files will be recovered, it may embolden adversaries to target more organizations and encourage other criminals to distribute ransomware, and it may fund illicit activities. They urge victims to report the incident whether or not they pay. NIST IR 8374 Rev. 1 states management's dilemma plainly: pay the ransom and hope the attackers keep their word to restore access and not disclose data, or do not pay and restore operations yourself. According to the 2026 DBIR, 69% of victims did not pay (up from 65% in 2024), and the median ransom paid fell from $150,000 to $139,875.

When personal data is involved

If attackers reach personal data, the incident may also fall under the KVKK (Türkiye's personal data protection law). Law No. 6698 requires the data controller to notify the data subject and the Board as soon as possible if processed personal data is obtained by others through unlawful means (Article 12(5)). We cover the law's general framework in our KVKK article, notification readiness in our data breach notification article, and why a ransomware victim was fined in our ransomware and KVKK article.

Frequently asked questions

What does ransomware mean? Ransomware is malicious software that encrypts files or locks a device and demands payment to restore access.

How does ransomware get in? The most common routes are unpatched vulnerabilities in internet-facing systems, stolen credentials, phishing, an earlier infection by other malware and access held by suppliers.

How do you protect against ransomware? The core controls are tested backups that attackers cannot reach, phishing-resistant MFA, fast patching, network segmentation, EDR and an exercised incident response plan.

If you pay the ransom, do you get your data back? There is no guarantee. The FBI and CISA say payment does not guarantee that files will be recovered, and they do not encourage paying.

What is double extortion? It is when attackers both encrypt the data and exfiltrate it, threatening to publish it if the victim does not pay.

Sources