What ransomware does — and why it works

Ransomware is malicious software that encrypts files — and, increasingly, steals data first — then demands payment for a decryption key or to prevent the stolen data from being published. Modern ransomware groups operate like businesses, often naming their victims publicly and applying pressure through countdown timers and leak-site posts. This is exactly the kind of activity threat intelligence monitoring tracks: the moment a group claims a new victim, it's visible on the leak site within minutes.

Ransomware succeeds because a single entry point — one clicked link, one weak remote-access password, one unpatched system — can spread across an entire network within hours. What starts as one compromised laptop can become a company-wide outage by the next morning if it isn't caught early.

Double extortion has become the norm: attackers don't just encrypt data, they exfiltrate a copy first, so paying for a decryption key doesn't guarantee the stolen data won't still be leaked or sold. This changes the calculus for organizations considering whether to pay.