What is Ransomware?
Ransomware is a form of cybercriminal attack that encrypts data on computers, tablets or mobile devices and demands payment in exchange for a decryption key. The threat can impact businesses big and small, governments, health care organizations and individuals.
Targets
Ransomware attacks are designed to target small and midsize businesses, which often have weaker cybersecurity measures than larger companies. They also tend to have weak passwords or leave vulnerable software unpatched, which makes them a tempting target for attackers who can then gain access to the company’s network.
Typically, ransomware begins when an unsuspecting user opens a malicious email attachment or clicks on a malware-laden website. Once installed, the ransomware agent encrypts all the files on the victim’s PC or attached file shares.
The malware then displays a message on the infected device announcing that files have been encrypted and that money must be paid in order to get them back. Generally, the victim is given a certain amount of time to pay or the ransom will increase.
Most experts advise against paying the ransom to avoid further exploitation of the victim and reducing the chance that the attacker will provide a decryption key after payment. However, some victims have experienced that even when they pay the ransom and receive a decryption key, it may not unlock their data.