Ransomware is a form of malware designed to encrypt files on a device, rendering any files and the systems that rely on them unusable. Malicious actors then demand ransom in exchange for decryption. Ransomware is often designed to spread across a network and target database and file servers, and can thus quickly paralyze an entire organization. It is absolutely true that adversaries behind ransomware are targeting organizations of all sizes and industries. Ransomware encrypts your critical data and can bring your organization to a halt. Mitigation strategies start with awareness and prevention. It is a growing threat, generating billions of dollars in payments to cybercriminals and inflicting significant damage and expenses for businesses and governmental organizations. The attacker makes the private key available to the victim only after the ransom is paid, though as seen in recent ransomware campaigns, that is not always the case. Without access to the private key, it is nearly impossible to decrypt the files that are being held for ransom. After a successful exploit, ransomware drops and executes a malicious binary on the infected system. This binary then searches and encrypts valuable files, such as Microsoft Word documents, images, databases, and so on. The ransomware may also exploit system and network vulnerabilities to spread to other systems and possibly across entire organizations.


Digital extortion is now the most prominent form of cybercrime, meriting attention to the whole process that companies may go through, including the decision and possible negotiation behind paying ransomware. Ransomware adversaries can appear fearsome to defenders who are facing the direct impact of an attack. Ransomware attackers don’t hesitate to exploit this, with threatening and aggressive behaviour and ransom demands. But it helps to remember that adversaries are human too, and as capable of making mistakes as everyone else. Everything an attacker needs to pu.