Ransomware in plain English
The word ransomware combines “ransom” and “software.” It is sometimes also called extortion malware. Ransomware is a particularly damaging form of malware (malicious software).
Imagine someone breaks into your office at night and fits every filing cabinet with a new lock. On the desk, there’s a note: you’ll get the key in exchange for payment. To make sure you really pay, the burglar has taken copies of important files beforehand and threatens to publish them. That’s how ransomware works – only digitally and often across the entire corporate network at once. Experts call this combination of encryption and data theft double extortion.
The attacks are usually carried out by organized groups that divide up the work. In the “ransomware as a service” model, developers rent out their malware to accomplices, known as affiliates, who carry out the actual attacks and share the loot with them. Our Ransomware Response page explains what to do in an emergency.
How a ransomware attack unfolds
Many attacks follow a similar pattern:
- Initial access: The attackers gain access – for example via a phishing email with an infected attachment, via stolen credentials, or via an unpatched security vulnerability in a VPN gateway that employees use to connect to the corporate network remotely.
- Spreading: They escalate their privileges (privilege escalation) and move from computer to computer (lateral movement) – often over days or weeks, and unnoticed for a long time.
- Data theft: Confidential data is exfiltrated, such as customer data, contracts, personnel files, or design drawings.
- Sabotaging recovery: The attackers look for backups, delete or encrypt them, and disable security software.
- Encryption: Often at night or on weekends, they encrypt as many systems as possible at the same time.
- Extortion: A ransom demand appears on the screens, usually payable in cryptocurrency and with a tight deadline.
A practical example
A fictional but typical scenario: Monday morning at a machine manufacturer with several sites. No computer starts up normally, and a ransom demand is displayed on the screens. The production planning servers are encrypted too, and production grinds to a halt. It later turns out that the attackers had broken in weeks earlier via a VPN gateway for which a security update had been available for some time.
Fortunately, one backup had been stored separately from the network and remained intact. A forensic investigation determines how the attackers got in and which data was exfiltrated. This is the prerequisite for rebuilding the systems securely and assessing which reporting obligations apply. The company doesn’t pay a ransom, but it still needs several days to get back up and running.
Why does this matter for businesses?
In its reports on the state of IT security, the BSI (Germany’s Federal Office for Information Security) has for years rated ransomware as one of the biggest threats to companies and organizations in Germany. And it’s by no means only large corporations that are affected: many attackers scan for vulnerable systems automatically – regardless of size or industry.
The consequences reach far beyond IT: operational downtime, costs for recovery and follow-up work, and a loss of customer trust. If personal data is affected, the data protection supervisory authority must generally be notified – under Art. 33 GDPR, without undue delay and, where feasible, within 72 hours. In Germany, organizations covered by NIS2 must also report significant security incidents within fixed deadlines to the joint reporting office of the BSI and the BBK (Federal Office of Civil Protection and Disaster Assistance).
And the ransom? Paying guarantees neither working decryption keys nor the deletion of stolen data – and it finances further attacks. The BSI therefore advises against paying and instead recommends reporting the crime to the police without delay.
How to protect your organization
- Set up backups properly: Back up regularly, keep at least one copy disconnected from the network or immutable, and test the restore process.
- Close entry points: Install security updates promptly, especially for systems that are reachable from the internet. Structured patch management helps.
- Secure remote access: Protect VPN, email, and cloud services with multi-factor authentication.
- Divide up your network: Effective network segmentation splits the network into isolated zones and prevents attackers from spreading unhindered.
- Limit privileges: Use separate administrator accounts and grant only the rights that are strictly necessary.
- Detect attacks early: Monitor endpoints and logs so that anomalies don’t go unnoticed until the encryption starts.
- Keep an emergency plan ready: Define who makes decisions in an emergency and whom you call – and keep a copy of the contact list offline.
How Rootsektor can help
If the worst happens, our Ransomware Response team supports you remotely and on-site. Our digital forensics experts determine how the attackers got in, which systems and data are affected, and what is needed for a secure rebuild; we agree on scope and approach with you individually. You’ll find immediate steps and a reporting form under Report an Emergency. As a preventive measure, a penetration test shows which entry points attackers could use in your environment; you can describe your scope on our Pentest Quote page.