Keeper Security recognized in the 2025 Gartner® Magic Quadrant™ for PAM
Learn MoreCyber Threat: Ransomware Attack
Ransomware is a type of malware that encrypts data and holds systems hostage until a ransom is paid. Cybercriminals generally demand payment in cryptocurrency in exchange for a decryption key. However, paying the ransom does not guarantee that cybercriminals will fulfill their promise to return your data. Even if access is restored, sensitive data may still be sold on the dark web. No matter how big or small an organization is, ransomware attacks have severe consequences, including financial losses, operational disruptions, reputational damage and data breaches.
Cybercriminals infect systems through phishing emails, malicious attachments or by exploiting security vulnerabilities like stolen credentials. They often move laterally through the network before launching the attack to maximize damage.
Once inside, cybercriminals locate valuable data and encrypt files using military-grade algorithms. They may disable security tools, delete backups and compromise additional systems.
Files are locked and a ransom demand is delivered with a short deadline requiring a substantial payment in cryptocurrency - coupled with a threat to sell, leak or delete your sensitive data.
Crypto ransomware encrypts files using strong encryption algorithms and demands cryptocurrency in exchange for a decryption key. It blocks access to sensitive data and disrupts operations, with no guarantee of full data recovery even if the ransom is paid.
Unlike crypto ransomware, which encrypts individual files, locker ransomware locks users out of their entire device or system. It often displays a fake law enforcement message to scare victims into paying the ransom. This type of ransomware stops productivity completely until the system is restored.
In a double extortion ransomware attack, the cybercriminal extracts sensitive data and then encrypts it, demanding payment not only for decryption but also to stop the data from being leaked. Even if the ransom is paid, the data may still be exposed or sold on the dark web.
Triple extortion ransomware builds on double extortion ransomware by adding another layer of pressure. The cybercriminal steals sensitive data, encrypts it and launches additional cyber attacks, such as Distributed Denial-of-Service (DDoS) attacks or threats made to clients — amplifying business disruption and reputational damage.
RaaS makes ransomware accessible to less-skilled cybercriminals by offering it as a paid service. Affiliate cybercriminals launch the actual attacks, while the developers who create the ransomware take a portion of the paid ransom.
To remove ransomware, organizations must be careful and methodical to minimize the impact of any reputational damage and to restore operations safely.
Notify your organization's security teams and law enforcement if necessary. By reporting the ransomware attack early, authorities can help with coordinating remediation and handling legal compliance issues.
Disconnect affected computers or servers from the internet and network to prevent ransomware from spreading to other devices.
Although some types of ransomware can still function, most ransomware can be stopped by rebooting infected devices into safe mode. Doing this also gives you time to install trustworthy antivirus software.
Secure internal web-based applications, cloud apps and BYOD devices from malware, prevent data exfiltration and control browsing sessions with full auditing, session recording and password autofill.
Achieve zero standing standing privileges and enable Just-in-Time (JIT) access across all Windows, Linux and macOS endpoints, with optional approval workflows and MFA enforcement.
If possible, use legitimate decryption tools, such as those listed on No More Ransom, to unlock encrypted files. Avoid suspicious third-party tools that could make the situation worse by stealing or altering your data.
Frequent, automated backups are the most effective defense against ransomware. Make sure all backups are stored offline and tested regularly to ensure you can recover data without paying a ransom.
Phishing emails are a common attack vector for cybercriminals to initiate ransomware attacks. Best practices include using simulated phishing tests, regular security training and strong cyber hygiene to help employees identify and report suspicious emails.
Cybercriminals often exploit unpatched software vulnerabilities in operating systems, software or devices to gain access. Regularly apply security updates across all systems to stay protected and compliant with regulatory standards.
Cybercriminals often sell employee credentials on the dark web. Tools like BreachWatch® alert IT teams in real time if company credentials have been exposed, so they can respond quickly and secure compromised accounts. Run a free dark web scan today to see if your company's credentials have been exposed.
Cybercriminals often take advantage of compromised, weak or reused passwords to gain unauthorized access. A business password manager like Keeper® helps enforce strong and unique passwords, supports Multi-Factor Authentication (MFA) and reduces the risk of password-based cyber attacks. For privileged accounts and critical systems, use a PAM solution like KeeperPAM® for full visibility over who has access to sensitive data and what they can do with that access.
You must accept cookies to use Live Chat.