Ransomware is a type of malicious software that scrambles the files on a computer or network with encryption the victim cannot undo, then demands payment — usually in cryptocurrency — for the decryption key. Since roughly 2020, most major crews run a double-extortion model: they copy sensitive data out before encrypting anything, so paying the ransom no longer guarantees that stolen records stay private. The defense that reliably works is offline or cloud backups the attackers cannot delete, combined with prompt patching.
KAJ News publishes information, not incident-response or legal advice; if your organization is under active attack, follow its incident plan and contact professionals.
How does a ransomware infection actually start?
Almost every infection begins with one of three doors. The first is a phishing email or a stolen password reused on a remote-access service such as RDP or a VPN with no second factor — the U.S. Cybersecurity and Infrastructure Security Agency lists phishing, exposed RDP, and credential abuse among the most common initial access vectors in its StopRansomware guidance. The second is an unpatched internet-facing appliance: firewalls, file-transfer tools, and VPN concentrators are favorite targets because a single flaw exposes hundreds of victims at once. The third is initial-access brokers — criminals who break in first and sell that access to a ransomware crew.
Once inside, the attackers work in stages. They plant remote-control tools, steal account passwords, map the network, and hunt for the backups. Only when everything valuable has been copied out do they trigger the encryption — usually at night or on a weekend, on every machine at once, so the victim wakes up to a locked network and a ransom note.
What is double extortion, and why do victims pay twice?
In the older model, restoring from a backup made paying pointless. So the crews added data theft. Before any file is encrypted, they exfiltrate documents, databases, email archives, and anything else that would embarrass the victim — personnel records, client contracts, patient files. Then the demand runs on two tracks: pay for the decryption key, and pay again — or face publication of the stolen data on a leak site. Some victims who restored cleanly from backups still paid the second demand to keep the leak quiet. Others refused and watched their data published. There is no outcome guarantee in either direction.
Who do attackers target?
Hospitals, school districts, municipalities, and mid-size manufacturers have been recurring targets because they cannot tolerate downtime and often run aging, unpatched systems. But the rise of ransomware-as-a-service lowered the skill floor dramatically: a top crew writes the malware and handles decryption support, while paying affiliates — often less skilled operators — do the break-ins and keep most of each ransom. This franchise model is why attacks cluster: many different affiliates hit whatever sector is soft this quarter using the same rented toolkit.
What should you do right now?
Four moves cut most of the risk, and all four are cheap:
- Keep one backup copy out of reach. Follow the 3-2-1 pattern — three copies of important data, on two different media, one kept offline or in immutable cloud storage that normal credentials cannot erase. Ransomware crews hunt and delete reachable backups first.
- Turn on multi-factor authentication for email, VPNs, remote access, and backup consoles. Stolen passwords are the front door; a second factor closes it.
- Patch internet-facing devices first. Firewalls, VPNs, email servers, and file-transfer tools should be updated within days, not months, of a vendor advisory. CISA's Known Exploited Vulnerabilities catalog lists the flaws attackers are actively using.
- Segment and least-privilege. A regular user account should not be able to reach the backup server. Separate admin accounts, used only for admin tasks, blunt the blast radius of any single infection.
Should victims ever pay the ransom?
The FBI and CISA advise against paying, in their public statements on ransomware: payment funds the next attack, does not guarantee usable decryption or deletion of stolen data, and some payments may violate U.S. sanctions law if the recipient is a designated entity — a determination only regulators and counsel can make. Decryption tools released by researchers occasionally recover files for older strains for free; check CISA's StopRansomware resource pages before assuming payment is the only path. The practical answer is that organizations that can restore quickly from protected backups rarely face the question at all.
Are attacks getting worse?
By every public measure, yes. The Identity Theft Resource Center's annual breach reporting has set successive records for compromise events in the U.S., with ransomware a leading driver, and security firms tracking victim counts on leak sites have reported year-over-year growth through 2025. Two trends stand out as of 2025: attacks that first breach a vendor or managed service provider and cascade to hundreds of downstream customers, and quiet extortion-without-encryption, where data is simply stolen and held hostage. Both make the unglamorous basics — backups, MFA, patching, segmentation — worth more than any single product purchase.
For more context, read Infostealers explained: the malware that empties your password manager for you.
For more context, read what is a botnet.
For more context, read vishing.