September 15, 2025
Why “we already have that data” is bullsh*t
CybSafe’s CEO and founder Oz Alashe unpacks why your colleagues keep missing the point on behavioral risk – and what to do about it
Ransomware is one of the most serious and damaging threats to cybersecurity, with its ability to wreak havoc on personal computers, corporate networks, and even public infrastructure. Part of the danger lies in its potential to facilitate data breaches, which can lead to a loss of sensitive information and further exacerbate the crisis.
But plenty of people, including inside your organization, are still asking: ‘what is ransomware?’ And even those in the know need briefings to keep up to speed on what’s lurking out there, including the potential data breaches that can result from a successful ransomware attack. These are hoping to deliver chaos in exchange for cash.
But we’ve got you covered, because we’re about to run through the nuts and bolts and then build on that with how ransomware works, what makes it such a dangerous threat, and we’ll walk you through a ransomware Most Wanted.
In other words, you’ll know what you’re up against and how best to protect your people and systems against it, including securing your data to prevent beaches.
Stay informed and stay safe.
Let’s do this!
We’ve broken our ransomware guide into the following categories:
Don’t @ us. We know it’s a cliche to start with a definition but, what can we say, it’s a very good place to start.
The definition of ransomware is a type of malicious software, or malware, that cybercriminals use to encrypt files on a device, holding them hostage until a ransom is paid.
There you go. That was over quickly, wasn’t it? It’s a short definition because ransomware can be and do a lot of things in a lot of places:
And, with the internet connected to almost every device we’ve expanded our horizons, but from now on, we’ve also opened up our entire worlds to possible ransomware threats.
The truth is this: Ransomware can be used to attack any size network. It doesn’t matter whether you’ve just got individual computers or huge enterprise servers. Either way, it can pose a huge threat to financial data and other sensitive information.
When attackers luck out with a vulnerable system, they break in using one of their favorite techniques, like:
But there’s a lot more to understand about this cybercrime MO. Organizations and people need to protect themselves from these cyber threats with the right security measures. It’s something we’re passionate about and we’ll look at how to do that later, but first: How does ransomware work?
"Cyber criminals behind ransomware will always target organizations with low levels of IT security, and who have a need to remain operational."
It’s important for anyone with access to your system to understand the basics of ransomware activity. Here’s our take.
So, if you’ve read this far (or if you’ve spent at least 3 minutes in a cybersecurity role), you’ll know how ransomware is an attack that encrypts data on a computer or network, often posing a threat to financial data, not to mention other sensitive information, and then asks the victim to pay a ransom.
But how does it actually work? Ransomware attackers usually follow these three steps…
Like any viral malware, a ransomware virus has a multitude of ways to enter and infect your system, like our good old friend, phishing emails. But we know it’s not news to you or your security team that all it takes is someone clicking on a link in a malicious email.
But that doesn’t make it any less chilling, especially when someone in your organization happens to click on the link and inadvertently welcomes the malware in like a long-lost friend, maybe offers it a hot beverage and hangs up its coat for it.
Phishing is talked about a lot, but how many of your people have heard of Remote Desktop Protocol, or RDP? Would they know what to do if cyber attackers tried to infect their computer using it?
RDP’s power move is guessing or stealing login credentials to remotely access the system. That makes downloading and executing malware a doddle.
We could go on. There are other ways, and cyber criminals are inventive finding new ways all the time. But that’s step one - infection.
What comes next?
So, the malware has unpacked and made itself at home in the blink of an eye.
That’s when the data encryption starts.
What few people realize is–frighteningly–this only requires accessing the files, encrypting them with an attacker-controlled key, and then replacing the originals with the encrypted copies.
Experienced malware designers know they must maintain system stability, so the majority of ransomware variants are selective in the files they choose to encrypt.
Today’s variants have fewer blind spots too. For instance, to make recovery without the decryption key even more challenging, they will erase backup copies of encrypted files, leaving organizations firmly in a no-win situation.
All that’s left to do is for the ransomware to make itself known–and start making it rain!
AKA the part where blissful ignorance becomes sweaty terror.
After encryption comes the payment demand. One of the most popular options attackers employ is changing the background image to display the ransom note. Another favorite is making the ransom demand via text files attached to the encrypted data.
However they’re displayed, these messages often demand a predetermined sum–usually in bitcoin or another cryptocurrency– in return for access to the victim's data.
The now-considerably-richer attacker should then provide the means to decrypt the data, be it a copy of the symmetric encryption key itself or a copy of the private key that was used to protect it.
Did you spot the ‘should’ back there? Yeah. Let’s get onto that
Unless you keep up to date with cyberattack news reports it’s easy to underestimate the scope, the power, the danger of ransomware. So, just in case you were starting to get too relaxed, here’s just a flavor of the world we’re living in.
SonicWall estimated 623 million ransomware attacks throughout the course of the year 2021. Download report
But where did it all begin? Where did it all start going right for ransomware?
The beginning of ransomware goes as far back as 1989. That’s when the first type of malicious software called AIDS Trojan (or Aids Info Disk/ PC Cyborg Trojan) was released by US biologist Joseph Popp. Popp sent over 20,000 floppy disks with the first-ever version of ransomware on them to AIDS researchers in more than 90 countries.
Once inserted, the disk would download the ransomware, ready to be activated at a later date and hold their computers hostage. That piece of malware, cheerily coined the AIDS Trojan horse (or Aids Info Disk/ PC Cyborg Trojan), is where it all began.
Ever since, cybercriminals have become increasingly sophisticated in their efforts to extort personal and financial data from unwitting tech users.
Throughout history, crypto has dominated as the primary type of ransomware. But it has a less popular sidekick: locker ransomware. And more recently Ransomware as a Service (RaaS) is proving a popular choice.
First let’s look at locker ransomware. This blocks access to your computer systems hook, line, and sinker…
This devilishly clever variation infiltrates systems using social engineering strategies and credentials that have been compromised. Threat actors then enter the system and stop you from using it until a ransom is paid.
Compared to locker ransomware, crypto ransomware is much more common. It encrypts all or just a portion of the computer’s files and asks the victim to pay a ransom in exchange for the decryption key. Some more recent variations also infect networked, cloud, and shared storage.
Ransomware as a service (RaaS), which has unfortunately grown in popularity, is where attackers pay to rent access to a specific type of ransomware, usually from its creator or developer.
Hosted on the dark web, RaaS allows criminals to subscribe to the tools of the trade rather than make their own. That means they can get down to the important business of attacking computers and databases.
The fee paid by the criminals normally depends on the features and the complexity of the ransomware. Once the attackers have gained the ransom money, the creator gets their cut, which could be as much as 20 or 30 percent.
The birth of RaaS tells us how organized ransomware is getting. And if that doesn’t hammer home how vital it is to beef up your cyber defences and human cyber risk management we’re not sure what will.
Here it is–our ransomware Rogues’ Gallery. It’s not the cutest tour you’ve ever been on, granted. But keep on checking back, because we’re tirelessly tracking new ransomware threats, so you can stay on top of thwarting them.
Ransomware may not be young, but it’s an alarming threat in today's digital world, and countless people have their data held hostage every single day.
The best way to avoid your organization falling victim to ransomware, is to help people take proactive steps to raise and strengthen the defenses.
We’re not going to tell you to install anti-virus and security software on all your devices (though you should). And we’re not going to nag you about regular and separate backups of all important files. If you’re reading this, we’d bet you’re ticking those boxes already.
But it’s crucial to understand the role that behavior plays in guarding against cyber attacks. Don’t get us wrong: people aren’t the weakest links or the strongest tool in the box. They are simply people.
Plus, scammers are nothing if not dedicated! Their day job is to make a phishing email, for example, look as real and genuine as they can, so people don’t think the ‘don’t click on unknown sources’ advice they received in their super-basic awareness training applies here.
Speaking of super basic training, boring compliance frameworks that tick legal obligation boxes have overstayed their welcome.
They don’t help you fight against real world cyber attacks. Compliance as a metric for success guarantees one thing alone: safety blind spots, which leads to a false sense of security.
These out-of-date systems don’t actually influence long-term security behaviors and, therefore, don’t reduce human cyber risk.
So, what does work?
The key to transforming security behaviors in your organization is this: It starts by exploring what a modern security solution looks like.
We know certain security behaviors sit at its core. When people create strong passwords, add multi-factor authentication, and protect their online privacy, they are strengthening the all-important human layer of security.
And when organizations guide people on how to stay secure with remote work, how to use a VPN, make frequent backups, and ensure auto-updates are on, they are making it harder for criminals to get through.
Your people’s experiences matter. So it’s vital to get those phishing simulations right, and to do all you can to influence healthy long-term security behaviors.
It’s what will keep you ahead of the ever-evolving compliance standards, and help you fortify your human layer of security and prevent ransomware.
Your data is precious to attackers, so they don’t make it easy to recover ransomware data. The malicious and encryption efforts the malware uses aim to make recovery very tricky.
But, fortunately, there are ways that victims can recover ransomware data without paying a fee.
Methods of ransomware recovery can include utilizing false decryption tools or manual methods such as restoring backed-up files with updated anti-ransomware software.
Some attacks buckle upon running an antivirus scan (though you definitely shouldn't base your cybersecurity policy on this potential stroke of luck), or sometimes restoring your computer to an earlier version works.
Wise to this, some attackers will delete these backup files to keep the upper hand. So, the best place to start with your ransomware incident response is to find out what type it is and then you can move on to how to remove it.
No matter what steps you take, having a thorough knowledge of ransomware, in general, is key to thwarting future attacks.
That said, information is only a part of the picture. Influencing people’s security behaviors is the single most effective way to tip cyber risk in your favor, rather than in the favor of greedy cybercriminals out to spoil your day.
Empower your people and reduce risk
Looking to upgrade your organization's cybersecurity practices?
One thing’s for sure: traditional security and awareness training doesn’t change risk. That’s because it doesn’t change the way people act in the long term. And that’s the key - influencing people’s behavior, so they make good security choices every time.
We believe that people play a crucial role in protecting against cyber threats, which is central to our ransomware report. It provides valuable information to influence security behaviors and reduce cyber risk. It’s an essential tool for anyone staring down ransomware or other risks. So, everybody, really...
Download Our Ransomware Report to Strengthen Your Cybersecurity Defenses.
Download our ransomware report now
What is double extortion ransomware?
Ransomware that uses both data export and file encryption is known as double extortion. If the attacker’s demands are not satisfied, they threaten to disclose stolen material.
The winning feature here is that the attacker still has control over the victim even if they are able to recover their data from a backup. However, since the attackers have access to the stolen data, paying the ransom does not ensure that the data will be protected either.
What is a ransomware family?
No, it doesn’t mean they’re forced to spend the holidays together.
A ransomware family is a malware strain made up of similar versions of ransomware. It usually consists of different variants of the same code, which can be released by one hacker or group.
Ransomware families are designed to target specific systems and can spread quickly through email campaigns, malicious links and downloads, or even through vulnerable networks.
Each variant within a ransomware family may have its own unique features, but their core purpose remains the same—to demand payment in exchange for restoring access to locked or encrypted data.
What is the encryption type frequently used by ransomware-type malware?
Ransomware is a malicious software that commonly relies on powerful encryption methods, such as symmetric algorithms like AES (Advanced Encryption Standard) or DES (Data Encryption Standard), as well as asymmetric ciphers that utilize both a public and a private key.
AES means the same encryption key is used to both encrypt and decrypt data. It is one of the most secure encryption methods used in ransomware-type malware.
What encryption algorithm is used in the KillDisk ransomware attacks?
Using the aforementioned Advanced Encryption Standard (AES), KillDisk encrypts files on the affected machine. It typically uses a 256-bit key, although some variants may use up to 1024 bits, making it incredibly difficult to crack.
What is a ransomware canary?
This is a security measure designed to detect if a ransomware attack has occurred in a network or system. A canary is a file or directory with a unique name that is placed in a sensitive location on the network or system. The file is then monitored for changes, and if it is modified or deleted, an alert is triggered, indicating a potential ransomware attack.
By detecting changes to the canary file, security personnel can respond quickly to a ransomware attack and prevent it from spreading to other parts of the network. The canary acts as an early warning system that helps organizations achieve strong system and data protection from ransomware attacks.
The name is a reference to birds carried down into mines to alert miners to dangerous gasses by …dying. Luckily, with ransomware canaries, no animals are harmed, and they may save you some serious stress.
What is commodity ransomware?
Commodity ransomware is widely available for purchase or rent by cybercriminals on the dark web. It is often used by less experienced hackers who lack the skills to create their own malware, but can easily buy or rent a pre-built ransomware kit.
Commodity ransomware is typically designed to be easy to use and requires minimal technical knowledge, allowing even non-technical individuals to launch a ransomware attack.
