Crypto glossary
Ransomware
Ransomware is malware that encrypts or steals an organisation's data and demands a ransom, usually in bitcoin or Monero, to unlock it or keep it private.
A ransomware attack typically starts with stolen credentials, phishing or an unpatched server. Once inside, the attackers spread through the network, copy sensitive data, then encrypt systems and leave a note with payment instructions. Most groups now practise double extortion, threatening to publish the stolen data even if the victim can restore from backups. Many operate as ransomware-as-a-service, renting their tools to affiliates for a cut.
Crypto is the payment rail because it moves across borders quickly without a bank. Bitcoin remains common, though some gangs ask for Monero. The trail is not as dark as criminals hope: blockchain analysis firms follow ransom payments to exchanges, and in 2021 US authorities recovered part of the bitcoin ransom paid by Colonial Pipeline. Payments to sanctioned groups can also breach OFAC rules.
Paying offers no guarantee that data will be decrypted or deleted, and it funds further attacks, which is why law enforcement discourages it. Prevention is mostly ordinary security: offline backups, patching, multi-factor authentication and network segmentation. Ransomware is distinct from cryptojacking, which quietly uses victims' resources rather than holding them hostage.
Example
A hospital's systems are encrypted overnight; the attackers demand bitcoin within 72 hours and threaten to leak patient records, while the hospital restores from offline backups and calls the police.
Related terms
Latest articles on Ransomware
- Russian Hacker Sentenced to 81 Months for $9M Ransomware Scheme
- Ransomware Incidents Surge but Payouts Shrink, Chainalysis Reports
- Ransomware Payments Drop 8% Even as Claimed Attacks Soar
- DeadLock Ransomware Uses Polygon Smart Contracts for Evasion
- $1 Billion Crypto Ransomware Heist Unveiled – Is Your Data Safe?