Ransomware Explained: How It Works and Why Paying Is a Bad Idea

Ransomware is the digital equivalent of someone changing every lock in your house and then offering to sell you the keys. Your files are still sitting on the disk, just scrambled with a key you do not have. Nothing looks destroyed, which is exactly why so many people pay.

That is the trap. Payment is slow, expensive and often pointless — and depending on who is behind the attack, it may also be unlawful. Understanding what actually happens during an incident makes the right response much easier to see.

What Ransomware Actually Does

Older ransomware simply locked files and demanded money. Modern attacks add a second move: the intruders copy data out before they encrypt anything. Customer lists, contracts, payroll records, private messages — all of it gets packed up and uploaded to servers the attackers control. The encryption is the shock tactic. The stolen data is the leverage.

That combination is usually called double extortion, and it matters because restoring from backup no longer ends the story. You can hold a perfectly clean copy of every file and still face a threat to publish what was taken.

The encryption itself is not mysterious. Each file is rewritten using a strong cipher, the original is deleted, and a new extension is tacked onto the filename so the damage is visible. A ransom note appears in every folder. Attackers also tend to delete shadow copies — the feature behind Windows' "Previous Versions" — which is why that recovery trick usually fails.

How the Break-In Usually Happens

Most incidents start with something unremarkable. A staff member opens an invoice attachment. An ex-employee's account still has remote access enabled. A firewall appliance missed a patch eighteen months ago. Ransomware crews are opportunistic: they scan, they test credentials, and they walk through whatever door is left unlocked.

The usual entry points look like this:

• Phishing emails carrying a malicious attachment or a link to a convincing fake login page
• Stolen, reused or guessed credentials for VPNs, remote desktop services and admin panels
• Unpatched internet-facing devices — firewalls, VPN gateways, mail servers
• A compromised supplier or IT provider with trusted access to your network
• Fake software updates and pirated downloads

The quiet phase is your opportunity

Attackers rarely strike the same hour they break in. They spend days or weeks inside, creating accounts, disabling security tools, mapping where the backups live, and testing how far they can move. Any of that activity is a chance to catch them early: logins at odd hours, a sharp rise in file access, an antivirus alert somebody clicked past. Logging and alerting are not paperwork. They are the difference between a bad afternoon and a lost quarter.

Why Paying Is a Bad Idea

The appeal of paying is obvious. The problems with it are less so, and they are substantial.

• The decryptor may not work. Partial or total failure is common, and the tool you receive often runs slowly or corrupts large files. You can pay in full and still not recover everything.
• You become a known payer. Criminal groups trade information about which victims pay. Expect to be targeted again, sometimes within months.
• Your data can still be leaked. A payment buys a promise from people who break promises for a living. Nothing stops them from selling the files anyway.
• Negotiation takes time you do not have. Talks can drag on for days while your business is frozen, and the price often climbs as they learn more about you.
• Insurance may not cover it. Many policies handle recovery costs but exclude the ransom itself, or require you to involve approved specialists first.
• It may be illegal. Sanctions rules in several countries can make payments to specific groups unlawful for organisations. For a business, that is a question for a lawyer, not a judgement call.

Paying also funds the next attack. Every ransom that gets paid makes the business model work, and the target list grows.

What Recovery Actually Looks Like

If you are dealing with an infection right now, the order of operations matters as much as the actions themselves.

1. Isolate, but do not wipe. Disconnect affected machines from the network and disable Wi-Fi. Avoid powering off or reinstalling where you can — memory contents and logs are evidence, and they help specialists identify which ransomware family you are facing.
2. Tell the right people, quickly. That means leadership, your IT or security team, your insurer and legal counsel. Many jurisdictions impose breach notification deadlines, and those clocks start early.
3. Check for free decryptors. Law enforcement agencies and security researchers maintain public libraries of decryption tools for known ransomware families. It costs nothing to check before you consider anything else.
4. Assume data was taken. Look for evidence of large outbound transfers before you conclude that only encryption occurred.
5. Restore from clean backups, then verify. Wipe and rebuild rather than cleaning infected systems. Rebuilding takes longer and is far more trustworthy.
6. Reset everything. Rotate every password, revoke active sessions and access tokens, and require multi-factor authentication on remote logins and email accounts.

Backups are the whole argument

When you have a recent, tested, offline copy of your data, ransomware becomes an expensive inconvenience instead of an existential threat. Keep at least three copies, on two different kinds of media, with one held offline or in immutable storage that cannot be deleted by an attacker. Then practise restoring. An untested backup is a hope, not a plan.

Prepare Now, Not Later

Write a one-page incident plan and keep a printed copy somewhere physical, because your network may be the last place you can read it. List who can make decisions about money and downtime, and get their contact details onto paper. Turn on multi-factor authentication, close the remote access you are not using, and patch the devices exposed to the internet. Ask your backup provider whether an attacker with your admin credentials could delete your backups — and if the answer is yes, fix that first.

If an attack does land, treat it as a security and legal problem rather than a payment problem. Get professional incident response and legal help on board early, follow the plan, and let the backups do the work. That is the version of this story that ends with a resumption, not a receipt.

Photo: Tranmautritam / Pexels