Ransomware

Ransomware is malicious software that encrypts files on an infected device, or across the whole network it can reach, and then demands payment for the key needed to decrypt them. From the attacker's point of view the purpose is direct financial gain, which is why ransomware is one of the most widespread forms of malicious software. Unlike many other kinds of malware, ransomware announces itself, usually through a text file demanding payment.

In practice, ransomware usually reaches a network through a phishing email with an infected attachment or link, less often through an exploited vulnerability or an exposed remote access point. The time from infecting a single device to full encryption can range from minutes to days, depending on how far the malware can spread across the network. An attack usually only becomes visible once files suddenly carry a new file extension and can no longer be opened.

A common misconception is that paying the demanded amount guarantees decryption, or that a backup is enough protection on its own if it sits on the same network and gets encrypted along with everything else. It's equally risky to assume a small business isn't an interesting target – ransomware usually spreads automatically and doesn't discriminate by company size.