How Ransomware Actually Gets You, and the One Thing That Beats It

Ransomware is malware that locks up your files and demands money to get them back. You turn on your computer, your documents and photos all have strange new extensions and won't open, and there's a note explaining how to pay in cryptocurrency for the key. It's one of the nastiest things that can happen to a person or a small business, because it goes straight for the stuff you can't replace.

The "locking" is just encryption. The same kind of strong encryption that protects your bank login is being used against you. The attackers encrypt your files with a key only they have, and without that key there's no realistic way to decrypt them. Occasionally researchers find a flaw in a particular strain and release a free decryptor, but you can't count on that.

How it gets in

It almost never shows up out of nowhere. There are a handful of common doors.

Phishing is a big one. An email with an attachment or a link, made to look like an invoice, a shipping notice, a shared document. Open it, enable whatever it asks you to enable, and the first piece of malware is running.

Stolen or weak passwords are another. Especially on things exposed to the internet like remote desktop, VPN logins or admin panels. If a login is reachable and only protected by a password that's been reused or leaked, someone will eventually walk right in.

Unpatched software is the third. Attackers scan the internet for devices and servers running versions with known holes, often things like VPN appliances or file-transfer servers, and break in without any password at all.

Against businesses, attackers often don't encrypt immediately. They get in, poke around, find the backups and the important servers, copy data out, and only then set off the encryption. That last part has turned into "double extortion": pay or we encrypt your stuff, and also pay or we publish what we stole.

What actually protects you

Backups that ransomware can't reach. This is the one. If you have a clean copy of your files somewhere the malware can't touch, ransomware goes from catastrophe to an annoying weekend. The key words are "can't reach." A USB drive that's always plugged in gets encrypted along with everything else. A network share your computer can write to gets encrypted too. You want at least one copy that's offline (a drive you plug in for backups and then unplug) or that's immutable, meaning the backup service keeps old versions that can't be changed or deleted for a set time, even with your credentials.

Cloud sync like Dropbox or OneDrive isn't a backup on its own. If your files get encrypted, the encrypted versions sync right up. That said, most of these services keep version history, and some have specific ransomware recovery features, which can save you. Know how yours works before you need it.

And test restoring. A backup you've never restored from is a hope, not a backup.

Updates. Turn on automatic updates for your operating system, browser and anything exposed to the internet. A lot of break-ins use holes that were fixed long before.

Two-factor authentication everywhere it's offered. Especially email, remote access, and any admin logins. A stolen password alone stops being enough.

Don't expose what doesn't need exposing. Remote desktop should never be open directly to the internet. Put remote access behind a VPN or a proper zero-trust tool with MFA.

Use a normal account day to day, not an administrator one. Malware that runs with limited rights can do less damage.

If it happens

Disconnect the affected machine from the network right away (pull the cable, turn off Wi-Fi) so it can't spread. Don't wipe it yet if you might need it for investigation or insurance. If you're a business, call whoever handles your IT and report it to the authorities. If you're an individual with good backups, wipe and restore.

Paying is a personal and legal decision I'm not going to make for anyone, but go in clear-eyed: it doesn't guarantee you'll get a working decryptor, it doesn't guarantee stolen data gets deleted, and it marks you as someone who pays.

If you only do one thing after reading this, make it an offline backup of the files you'd be devastated to lose. Everything else lowers the odds. That one changes the outcome.