Ransomware: How It Works, Costs, and How to Stop It

Ransomware is a malicious attack during which threat actors encrypt an organization’s data by locking up the files, harming the devices and demanding payment to restore access. If the system is infected, the organization may face a terrible choice of negotiating the terms of payment with the attackers with no guarantee and also of restoring access from the backups while the business loses its reputation.

In short terms, ransomware is still considered the most common kind of cyberattack, which is used by the potential threat actors (attackers) to cause significant damage to the organization. But, at the same time, it is getting less profitable these days with the advancement of security systems. 

According to Verizon’s 2026 data breach investigations report, ransomware caused 48% of the breaches, compared to 44% the year before. And yet, 69% of the affected victims refused to pay the sum of money the attackers demanded. 

The blockchain analysis firm chain analysis observed that roughly $820 million was paid in ransom payments during the year 2025, an estimated 8% fall-down recorded to the previous year in spite of the fact that the number of claimed attacks surged about 50%.

The rest of the article focuses on how a malicious attack develops, the entry points that are used by the attackers to get access to the system, how the attackers demand ransom to restore the organization’s access, what needs to be done once the breach occurs, how to decide the next steps and the procedures that need to be followed. Ransomware is one of the major types of malware discussed in our cybersecurity guide, which explains the NIST Framework, common cyber threats, security practices, and ways to protect systems and data. 

What Is Ransomware?

Ransomware is a type of malicious attack where attackers encrypt an organization’s data and demand payment to restore the access. In such cases, the files cannot be accessed without the encryption key that is with the attacker. The unique feature is that they make themselves known to their targets. Even if backups are stored outside the network, the attacker still has the leverage of the sensitive data. 

Most attacks nowadays come from ransom-as-a-service, in which attackers pose as a group to build and operate the malicious software and demand payments and a separate “affiliate”, which is a subgroup that attacks the victim networks and executes attacks, thus sharing the resulting profit. This is one of the reasons why the same brand name can be seen in numerous attacks across different countries.

In 2025 alone, the FBI’s Internet Crime Complaint Center has identified 63 new ransomware variants. These attacks averaged five per month across the variants. Brand names can be changed over the years, but the business infrastructure that is operating behind the scenes remains the same. 

What Are the Four Ransomware Extortion Models?

Attackers have steadily added pressure tactics on top of encryption. Knowing which one you’re facing changes your response.

Backups solve the encryption problem. They do nothing about stolen data. This difference is misunderstood the most by the security teams when it comes to planning against ransomware, and that is also one of the reasons why “we have backups” doesn’t solve the complete issue. 

How Do Attackers Get Into Systems?

The way attackers get into the systems has changed over the years. For years, stolen passwords were the leading route. In the 2026 DBIR, exploitation of software vulnerabilities became the most common way into a breach at 31%, ahead of credential abuse at 13%. Phishing held steady at around 16%.

Four entry points account for most incidents:

• Unpatched internet-facing systems: VPN appliances, firewalls and remote access gateways sit at the network edge, are reachable from anywhere and are often left unpatched for weeks. Attackers are constantly scanning for them.
• Stolen or reused credentials: Passwords bought from access brokers or harvested by info stealer malware, used on services that have no second factor.
• Phishing and pretexting: Pretexting, where an attacker builds a fake but plausible relationship with an employee before asking for something, has grown as a route into extortion attacks specifically. The DBIR also notes that phishing sent through mobile messaging gets clicked about 40% more often than email phishing.
• Third parties: Breaches involving a supplier, contractor or service provider rose 60% year over year and now appear in 48% of breaches. A managed service provider with access to hundreds of client networks is a single point of failure for all of them.

What Does a Ransomware Attack Actually Look Like?

Ransomware is the last step, not the first. A typical intrusion runs roughly like this:

1. Initial access: An exploited vulnerability, a stolen login, or a user who clicked something.
2. Establishing a foothold: The attacker installs tools that survive a reboot and give reliable remote access.
3. Privilege escalation: The attackers search for the login credentials of an administrator, repeatedly from a password manager or domain controller, in case it’s left unlocked.
4. Reconnaissance and lateral movement: The attackers plan the details of your network carefully in advance, then go through the file servers and figure out what actually matters. They spend days, sometimes weeks, in this phase of mapping out.
5. Disabling defences: Most of the attackers from the advanced modern groups use legitimate but exposed drivers to seal off the endpoint security at the kernel level before exploiting anything. In April 2026, the team of security researchers at Cisco Talos recorded that a Qilin loader is proficient at disabling more than 300 security drivers.
6. Destroying backups: Attackers intentionally target backup servers and cloud backup accounts because an organisation or victim with updated backups does not pay the ransom demanded. 
7. Data theft: Happens in the cloud storage where huge volumes of data get copied out while making it look like normal traffic.
8. Encryption: The attackers make sure to set off at night or over the weekend when no one is actively watching over the network.

Steps 3 through 7 are where defenders can really make a difference. An attack detected at step 4 is classified as an incident. The same attack detected at step 8 is a disaster.

How Much Does Ransomware Cost?

Cost figures vary wildly between reports because they measure different things. Here is what the main sources found and what each one is actually counting.

Those numbers look contradictory until you see what’s behind them. Chainalysis traces every payment on the blockchain, including thousands of small ones, so its median is low. Verizon and Sophos survey organisations large enough to have incident response, so their figures are higher. The FBI’s $32 million counts only what victims chose to report, and the report itself notes that this excludes downtime, lost business, equipment, and remediation, which is almost always the bigger number.

For most organisations, the ransom is not the main cost. Downtime is. Sophos found that 44% of organisations stopped the attack before encryption happened, a six-year high, and 97% of those whose data was encrypted did eventually get it back through one route or another.

What to Do in the First 24 Hours of a Ransomware Attack

Speed matters, but the wrong fast move destroys evidence and sometimes destroys data.

1. Isolate, don’t wipe: The first step is to disconnect the system that is infected from your network. But if you can, try not to wipe off the data or turn the device off as the forensic evidence or the encryption keys might sometimes be found in its memory storage.
2. Assume the attacker is still inside: The attackers still have lots of ways to get back into the system, and they go through your emails or activity. Make sure to direct the incident coordination to the channel they cannot access.
3. Check your backups before you touch them: The moment you decide to touch your backups, make sure they are undamaged and disconnected from the affected system or device. Reconnecting the clean backups to the infected network is the most costly mistake you could ever make in this whole process.
4. Bring in the people who handle this: Make sure you inform the team who is responsible for handling such attacks. This includes your cyber insurer, security team, incident response firm, and legal counsel. Make sure you check the policy terms before you hire an insurer, as they often demand you use their approved responders.
5. Report it: If you’re in the US, make sure you report it instantly to the FBI or CISA. Most of the countries have their own national cyber authority that handles such cases. By reporting, the free decryptors might become available to the victim.
6. Check for a free decryptor: The No More Ransom portal, which is run by the European and Dutch National Police with security vendors, presents free decryption tools for many disrupted strains. It only takes a matter of minutes of work, even though there’s a small chance of a positive outcome in this situation.
7. Identify what left the network: Before you come to the conclusion that there was no damage done to the network, make sure to check the firewall and cloud storage logs. This is because they are more important than anything else. 

What Are the Most Effective Ransomware Defences?

Ranked by how directly they address how attacks actually start and succeed.

• Patch anything exposed to the internet fast. Vulnerability exploitation is now the leading entry route. VPNs, firewalls, file transfer tools and remote access gateways come first, and their patch window should be days, not quarters.
• Multi-factor authentication everywhere it fits. This step is especially important for remote access, email, and any account with administrative rights. This method blocks a large share of credential-based entry outright.
• Backups the attacker cannot reach. The usual rule is three copies, on two types of media, one held offline or in immutable storage. The part people skip: restore a real system from backup on a schedule and time it. A backup that you have never restored is still just a hypothesis.
• Endpoint detection and response should be monitored by someone. Attackers dwell for days before encrypting. EDR gives you that window, but only if alerts reach a human who acts on them. Attackers also actively disable these tools, so tamper protection and alerting when an agent goes offline both matter.
• Limit what one account can reach. Segment the network, remove standing administrator rights, and treat domain admin as something used rarely and deliberately.
• Manage third-party access. Every supplier with a permanent Someone should monitor endpoint detection and response. and log it.
• Rehearse the plan. Run a tabletop exercise where the ransom note has already appeared. The questions you cannot answer in the exercise are your real gaps.

Related Articles:

• What Is Smishing In Cyber Security

• Password Management: How It Improves Security in Companies

• How To Become A Cyber Security Analyst