Ransomware

Ransomware is malware that encrypts data on infected systems and demands payment for decryption. It is distributed through phishing emails with attachments or links, through vulnerabilities in exposed services such as VPN gateways and RDP, and through compromised credentials. Modern variants use double extortion: data is exfiltrated before encryption and its publication is threatened. Network drives, backups and virtual machines are frequently affected as well. Effective protective measures include offline and immutable backups following the 3-2-1 principle, consistent patch management, network segmentation, multi-factor authentication, endpoint detection and response, and restricted administrator privileges. Tested contingency plans and a documented recovery process are equally important, as paying a ransom provides no guarantee that data will be returned.