(518) 292-4500
MSP 501 Winner 2025
Cybersecurity GlossaryWhat is Ransomware?
Ransomware is a category of malware that encrypts files and demands payment in exchange for decryption. Modern ransomware operations often also exfiltrate data first and threaten to publish it, creating a double-extortion model that survives even full backups.
How Ransomware works
Three-step view of how it operates in practice.
Intrusion
Attackers get in — usually through phishing, stolen credentials, or an unpatched internet-facing system. They often spend days moving laterally.
Exfiltration
Before encryption, modern ransomware gangs copy sensitive data out. This is leverage for double extortion.
Encryption & demand
Files are encrypted, backups deleted where possible, and a ransom note appears. Downtime begins.
Common ransomware delivery paths
A clear breakdown of the common variants.
Email-delivered
Phishing with malicious attachments or links to credential theft pages.
Exploitation of public services
Time-based one-time codes from an app like Microsoft Authenticator or Google Authenticator. Offline-capable and phishing-resistant against many attacks.
Compromised credentials
The user approves a sign-in with a tap on their phone. Easy to use but vulnerable to MFA fatigue attacks — always pair with number matching.
Supply-chain attack
FIDO2 keys like YubiKey, or device-bound passkeys. Phishing-resistant by design — the key will not authenticate against a fake domain.
Why Ransomware matters for SMBs
Ransomware is a category of malware that encrypts files and demands payment in exchange for decryption.
Common Ransomware mistakes
- Backups on the same network as productionModern ransomware hunts and deletes backups first. Immutable, offline, or air-gapped copies are essential.
- Untested recovery plansAdmins, finance, and anyone with access to money or sensitive data should use an app or hardware key — never SMS alone.
- No documented IR playbookDuring a ransomware event, every hour costs money. Pre-decided roles, contacts, and first actions save days.
- Relying on antivirusRansomware bypasses signature-based AV routinely. EDR with behavioral detection plus tested IR is the baseline.
Ransomware frequently asked questions
LogicalNet services related to MFA
Related glossary terms
Are your backups ransomware-proof?
Talk to a LogicalNet identity expert. We will review your current environment, recommend the right MFA methods for each group of users, and help you deploy without disrupting the business.