What ransomware does — and why it works

Ransomware is malicious software that encrypts files (and increasingly steals data first) and then demands payment for a decryption key or to prevent stolen data from being leaked. Modern ransomware groups run like businesses, often naming and publicly claiming victims to pressure them into paying — some of that same claim activity is what threat-intel monitoring tools track.

It works because a single point of entry — one clicked link, one weak remote-access password, one unpatched system — can spread across an entire network within hours.