What Is Ransomware?
Ransomware is malicious software that encrypts or locks an organization's files and systems, then demands payment to restore access. It renders files unusable (opens in new tab), along with the systems that rely on them, until the victim pays for a decryption key, and announces itself (opens in new tab) because the demand is the payload's purpose.
Many enterprise operators also steal data before encrypting it and threaten to publish it. This combination is called double extortion (opens in new tab).
How ransomware works
Enterprise ransomware is a staged intrusion (opens in new tab) in which encryption comes last. Attackers first need a foothold, and social engineering provides initial access by targeting help desks and identity workflows. Scattered Spider phones IT help desks while impersonating employees to obtain password and MFA resets, and stages lookalike domains (opens in new tab) such as targetsname-sso[.]com to harvest credentials.
With valid credentials in hand, attackers escalate and spread (opens in new tab). RansomHub affiliates (opens in new tab) ran Mimikatz to gather credentials and escalate to SYSTEM, then moved laterally over RDP, PsExec, AnyDesk, and Cobalt Strike.
Data exfiltration often follows as attackers use legitimate file-transfer utilities (opens in new tab) and rename them to blend in with normal processes. Recovery options go next. Phobos operators run vssadmin delete shadows /all /quiet to wipe shadow copies (opens in new tab) before the encryptor fires.
The Scattered Spider playbook (opens in new tab) demonstrates the sequence in a single actor's campaigns. Operators call outsourced help desks while posing as employees, obtain credential resets that bypass MFA, move through the victim environment, exfiltrate data, and deploy DragonForce ransomware against systems including VMware ESXi hypervisors.
Why ransomware is hard to stop
ClickFix relies on users mistaking malicious execution for routine verification (opens in new tab). Pages impersonating Cloudflare or Google CAPTCHA screens get users to paste a malicious command into the Run dialog. Interlock uses this technique as a delivery vector.
Among incidents Microsoft Defender Experts investigated over the past year, ClickFix was the most common initial access method, accounting for 47% (opens in new tab) of them. Because users execute the command themselves, ClickFix bypasses conventional download and attachment controls. Malicious advertising and poisoned search results similarly impersonate software brands and serve trojanized installers that attackers use before deploying ransomware.
Operators and affiliates split the work in a criminal supply chain. In the ransomware-as-a-service model (opens in new tab), operators provide payloads and infrastructure to affiliates that conduct intrusions. LockBit ran through many unconnected affiliates, so its observed tactics (opens in new tab) varied sharply from intrusion to intrusion. Initial access brokers (opens in new tab) sell enterprise access sourced from stolen credentials.
Ransomware appeared in 44% of 2025 DBIR breaches (opens in new tab), and victims' domains and corporate email addresses frequently turned up in infostealer credential dumps (opens in new tab) beforehand.
Law enforcement has disrupted major ransomware infrastructure (opens in new tab), including the LockBit platform, but operators and affiliates remain part of a fragmented ecosystem. Double extortion also removes the backup safety net. Once attackers exfiltrate data, restoring the files (opens in new tab) does not stop the leak.
Payment offers no exit either. A victim that pays still faces attackers who kept the data (opens in new tab) and repeat the threat months or years later.
Types of ransomware
Ransomware behavior splits into four actions paired with blackmail: Lock, Encrypt, Delete, and Steal (opens in new tab). Enterprise teams encounter these variants:
- Crypto-ransomware encrypts files and sells the key. Play uses hybrid AES-RSA (opens in new tab) encryption with a .PLAY extension. Medusa's (opens in new tab) gaze.exe terminates backup and security services, deletes shadow copies, then encrypts with AES-256.
- Double extortion pairs encryption with a leak-site threat. Interlock encrypts systems after exfiltration so victims pay for decryption and for silence.
- Data-theft-only extortion skips encryption. UNC6040 used vishing and malicious OAuth apps to steal Salesforce data (opens in new tab) in 2025 with no encryption component.
- Ransomware-as-a-service (RaaS) is the business model behind most of the above: developers build the payload and infrastructure, affiliates run intrusions, and the two split the ransom.
- Hypervisor and cloud-targeting ransomware encrypts many virtual machines at once through the centralized infrastructure that runs them.
Akira's Linux variant targets VMware ESXi (opens in new tab).
How to defend against ransomware
Defense starts at identity, because that is where many intrusions start. Deploy phishing-resistant MFA through Phishing-resistant FIDO/WebAuthn authentication (opens in new tab). Push-based MFA stays exposed to push bombing and SIM swapping. Enforce identity verification for account recovery, since attackers increasingly target help desks (opens in new tab) to reset credentials.
Train employees against the lures in current use on the channels where they arrive. Training should cover help desk impersonation on Teams, vishing calls, and fake CAPTCHA prompts. Then limit what a stolen credential reaches. Segment networks to contain lateral movement.
Remove permissions (opens in new tab) no longer required, disable RDP where it is not needed, and require MFA at every remote access point (opens in new tab). Keep at least one backup offline and isolated from production credentials, with three copies (opens in new tab) on two media and one off-site. Alert on anomalous use of common recovery-inhibition tools before encryption. Monitor vssadmin.exe, wbadmin.exe, and bcdedit.exe.
Watch outside the perimeter too. The lookalike SSO domain, the fraudulent Teams tenant, and the poisoned software download ad exist before attackers contact the first employee.
The UK's National Cyber Security Centre runs a takedown service that scans spam and phishing feeds for impersonating sites, issues takedown notices (opens in new tab) to hosting providers, and adds the sites to browser safe-browsing lists.
How Doppel helps
Doppel is the Frontier AI Social Engineering Defense (SED) platform that unifies Digital Risk Protection (DRP) and Human Risk Management (HRM). The platform detects the company-sso lookalike and dismantles it before an employee reaches it. Fake help desk personas and fake CAPTCHA pages receive the same treatment.
Brand Protection provides multi-channel coverage across domains, social, paid ads, and messaging. The Doppel Threat Graph links a registered domain, fraudulent Teams tenant, and vishing phone numbers into one campaign; agentic AI correlates and prioritizes signals and executes takedowns. Detected impersonation converts into an employee simulation in one click, matching the live lure.
Request a demo to see the impersonation infrastructure aimed at your employees and the takedowns Doppel has already executed against it, work that makes an organization too costly to attack.
Frequently asked questions about ransomware
What is ransomware?
Ransomware is malicious software that denies access to data or systems and demands payment for restoration. Ransomware includes attacks in which operators encrypt an organization's data and demand payment to restore access; under the current NIST definition (opens in new tab), they "may also steal an organization's information and demand an additional payment in return for not disclosing the information." Ransomware also includes malware that "prevents you from accessing (opens in new tab) your computer files, systems, or networks." Encryption is the usual mechanism. Attackers also lock screens or delete data.
What is ransomware in cybersecurity?
Security frameworks classify ransomware as an impact-stage technique. Ransomware appears in MITRE ATT&CK as T1486, Data Encrypted for Impact (opens in new tab), which covers adversaries encrypting data on local and remote drives and withholding the decryption key to extract payment. A wider model classifies ransomware through four actions, Lock, Encrypt, Delete, and Steal, combined with blackmail. The encryption event is the final step of an intrusion that began days or weeks earlier. Initial access may come from stolen credentials or a phishing lure, including a phone call to the help desk.
What is the difference between ransomware and data extortion?
Ransomware denies access to systems; data extortion threatens to expose stolen data. When attackers use data theft and release threats as the sole form of extortion without deploying ransomware, data-theft-only extortion remains a related but distinct category under US federal guidance (opens in new tab). Extortion-only is becoming a favored criminal tactic (opens in new tab) for some criminals, particularly against healthcare targets where patient privacy raises the stakes.
What is an example of a ransomware attack?
Interlock campaigns show the typical chain. Interlock gains entry through drive-by compromise, either hijacking a legitimate website or registering phishing domains that mimic news portals and software download pages and serve fake updates. Operators then establish access, move laterally with legitimate remote-access tools, exfiltrate data, and encrypt systems. Interlock uses double extortion, publishing stolen data if victims do not pay, and ClickFix delivery, in which fake verification pages trick users into pasting malicious commands