A ransomware attack is a type of cyberattack in which malicious software (malware) is used to block access to a victim’s files, systems, or entire networks by encrypting data or locking devices. The attacker then demands a ransom payment—usually in cryptocurrency—to provide a decryption key or restore access.
Ransomware attacks typically follow these stages: (1) Infection: The malware gains entry to a computer or network, often through phishing emails, malicious attachments, compromised websites, or exploiting vulnerabilities in remote access services like Remote Desktop Protocol (RDP). (2) Establishing Foothold: Attackers may install additional malware or create backdoors to maintain access and evade detection. (3) Encryption or Lockdown: Once inside, the ransomware encrypts files or locks the system, making data inaccessible to the victim. (4) Ransom Demand: The victim receives a ransom note with instructions on how to pay—commonly in Bitcoin or other cryptocurrencies—to regain access. Some modern ransomware also threatens to leak stolen data if the ransom is not paid (double extortion).