Glossary

#ransomware #backup #phishing #patch management

What is ransomware? How it works, how it gets in, and how to avoid paying

Ransomware is malware that encrypts your files and demands a ransom. Modern attacks add 'double extortion' — stealing data and threatening to leak it. How it works, the main entry routes (phishing, exposed VPN/RDP, unpatched flaws), and how to recover without paying — defense-only.

Published 2026-06-12 Updated 2026-10-06 9 min read

On this page

Ransomware is malware that encrypts your files and demands a ransom to restore them. Here's how it works and how to avoid paying (no attack steps).

How it works: a criminal business with divided roles

Classic ransomware encrypts every file it can reach on a device or server and leaves a note: "pay if you want the decryption key." But the real nature of today's threat is less about the technology and more about how it makes money.

Double extortion

Encrypt AND steal data, then threaten to leak. Decryption doesn't stop the leak

RaaS

Ransomware-as-a-Service: tooling is 'rented out,' increasing the number of attackers

Hours to days

Time from intrusion to encryption keeps shrinking — often too late by the time you notice

In double extortion, attackers exfiltrate data before encrypting. So even if a victim restores from their own backups, a second threat remains: "pay or we publish what we stole." That shift is why "we have backups, so we're fine" no longer holds on its own. On top of that, RaaS (Ransomware-as-a-Service) splits the work — those who build the tooling and those who run the attacks are now different people — which has sharply lowered the barrier to entry.

Main entry routes

Ransomware doesn't appear out of nowhere; it comes in through a predictable set of routes. Blocking them is the first defense.

1. Phishing

via email attachments / links. The most common door. defense = MFA, mail filtering, training

2. Exposed VPN/RDP

weak / no-MFA remote access. defense = require MFA, reduce exposure

3. Unpatched flaws

known vulnerabilities in internet-facing software. defense = patch promptly

Ransomware's three main entry routes. Every one can be blocked with defenses.

A real example we've covered, the mass MOVEit Transfer breach, saw a ransomware group exploit an unpatched vulnerability in internet-facing software and steal large volumes of data before a fix was available — a double-extortion case. It's a good reminder that "an email attachment" is not the only way ransomware gets in.

Ransomware vs typical malware

Ransomware is a kind of malware, but its goal and the moment you notice it are very different (→ what malware is).

	Typical malware (spyware and the like)	Ransomware
Goal	Steal information or control the device without being noticed	Stop the business and get a ransom paid
When you notice	Often runs unnoticed for a long time	Surfaces suddenly, with encryption and a ransom note
Main damage	Data leaks, fraudulent transfers, being used to attack others	Downtime, plus publication of the stolen data
What decides the outcome	Detection (EDR) and protecting credentials	Offline backups and keeping attackers out

Examples: ransomware incidents in Japan

These are Japanese cases covered on this site. Most entry points were internet-facing VPN appliances or stolen credentials.

Case	Reported entry point	Damage and recovery
Capcom (2020)	An old VPN appliance that was never decommissioned	Personal data of up to about 390,000 people possibly exposed; recovered from backups without paying
Handa Hospital (2021)	An unpatched VPN appliance vulnerability	Backups sat on the same network and were encrypted too; about two months to restore electronic medical records
Osaka General Medical Center (2022)	A catering contractor's VPN device	Intrusion came through the contractor; outpatient, surgery and emergency care were restricted; just over two months to full recovery
KADOKAWA (2024)	Credentials stolen by phishing, per the company's explanation	Many group services down for a long period; personal data of about 250,000 people leaked
Medica Shuppan (2026)	Intrusion using legitimate account credentials, per the company	About 641,000 people notified as "possibly leaked"

What they share is how the internet-facing entry points were managed and where the backups lived. How to protect VPN appliances is covered in VPN devices are ransomware's main way in.

Defense: make recovery-without-paying possible

Keep offline / immutable backups (most important)

Backups are what decide recovery. But an always-online, writable backup can be encrypted along with the rest, so keep at least one offline or immutable (tamper-proof) copy, and run restore tests regularly to confirm you can actually get data back. See backup and recovery essentials (3-2-1).

Prevent intrusion: MFA and patching

Require multi-factor authentication (MFA) on the biggest routes (phishing-prone logins and exposed remote access) and patch known vulnerabilities promptly on anything internet-facing. This alone stops a large share of intrusions (→ choosing MFA).

Limit the damage: least privilege and segmentation

So one compromise doesn't encrypt the whole company, keep privileges to the minimum needed and segment the network. Designing so a single compromised machine can't spread everywhere keeps damage local.

Have detection and an 'after we're hit' plan

Even with these defenses, prevention is never perfect. So detect anomalies early and decide in advance — in an incident response plan — who does what (isolate, notify, restore, in that order). Build the ability to contain and restore before anyone panics and pays.

This site's view: don't rely on paying; prepare in advance

On whether to pay, our position is clear: build the ability to not pay, in advance. Paying doesn't guarantee decryption; with double extortion it doesn't stop the leak either; and it funds crime while marking you as a payer who gets targeted again.

So what matters is preparation, not incident response: an offline backup you can restore, plus MFA and patching that keep attackers out. With both in place, ransomware damage stays at the level of an annoying but recoverable incident.

First steps when you notice an infection

Disconnect from the network

Unplug the network cable and turn off Wi-Fi to stop it spreading to other devices and backups. Avoid careless reboots or power-offs, which can erase records investigators need.

Contact your internal responders and outside authorities

In an organization, use the contacts you agreed in advance. Report to the police or your national cybercrime reporting channel, and if personal data may have leaked, check your data-protection authority's reporting rules.

Check for a decryptor and for clean backups

If the ransom note tells you the family, check No More Ransom for a free decryption tool. At the same time, confirm you have backups the attack didn't touch.

How to check your own setup

List the product names and versions of your internet-facing VPN appliances and firewalls, and check the vendor advisories and the CVE / KEV Lookup for exploited vulnerabilities still present
Make sure Remote Desktop (RDP, normally port 3389) can't be reached directly from the internet
Check that VPN and remote-access accounts require multi-factor authentication (MFA), and that no unused accounts remain
Confirm at least one backup lives somewhere the production credentials can't delete (offline, or with immutability turned on), and actually restore one file from it

"We have backups" no longer means "we're safe"

Backups used to make ransomware harmless. But now that double extortion is the norm, being able to restore is a different problem from preventing data theft. Attackers pull the data out before encrypting and then demand payment "or we publish it." So defense needs both: not just being able to restore (backups) but also keeping attackers from getting in or taking data out (intrusion prevention). The starting point for modern ransomware defense is refusing to stop at "but we have backups."

Sources (primary)

National Police Agency of Japan, "Ransomware damage prevention measures" (Japanese) — npa.go.jp (what to do when hit, and prevention)
No More Ransom, "About the project" — nomoreransom.org (free decryption tools)
CISA, "#StopRansomware Guide" — cisa.gov (offline backups and response checklist)
Personal Information Protection Commission of Japan, "Responding to leaks" (Japanese) — ppc.go.jp

Classification

CWE classifies the types of weakness behind vulnerabilities; MITRE ATT&CK classifies attacker techniques. Both are maintained by MITRE and widely used to label vulnerability reports and detection rules.

ATT&CK (attack technique)

T1486Data Encrypted for Impact

© 2026 The MITRE Corporation. This work is reproduced and distributed with the permission of The MITRE Corporation. MITRE ATT&CK and ATT&CK are registered trademarks of The MITRE Corporation. The MITRE Corporation (MITRE) hereby grants you a non-exclusive, royalty-free license to use ATT&CK® for research, development, and commercial purposes. Any copy you make for such purposes is authorized provided that you reproduce MITRE's copyright designation and this license in any such copy. ATT&CK Terms of Use

FAQ

QIf I'm hit by ransomware, should I pay?

Lean strongly toward not paying. Paying doesn't guarantee you get your files back, and it doesn't guarantee the stolen data won't be leaked. It also funds criminal groups and marks you as someone who pays, making you a repeat target (and paying sanctioned groups can carry legal risk). Many authorities discourage paying. That's exactly why preparation — offline backups you can restore without paying — matters most.

QHow does ransomware get in?

Three main routes. (1) Phishing email attachments or links, the most common route. (2) Internet-exposed remote access (VPN/RDP) that is weak or has no multi-factor authentication (MFA). (3) Unpatched, known vulnerabilities in internet-facing software. In short: human action, exposed remote access, and missing patches, all of which defenses can address.

QIs having backups enough?

Backups are the most important control, but with conditions. An always-online, writable backup can be encrypted along with everything else, so keep at least one offline or immutable (tamper-proof) copy and run restore tests regularly. And because modern attacks steal data before encrypting (double extortion), backups let you 'recover' but don't stop a leak; you also need defenses so attackers don't get in and exfiltrate in the first place.

QWhat is the difference between ransomware and malware?

Malware is the umbrella term for all malicious software, and ransomware is one kind of it. Most malware tries to stay hidden; ransomware announces itself by encrypting files and leaving a ransom note. Modern attacks, though, usually spend time inside the network stealing data before encrypting, so by the time you notice, data has often already left.

QWhat should I do first if ransomware hits?

Disconnect the affected device or server from the network first (unplug the cable, turn off Wi-Fi). Avoid careless reboots or power-offs, which can destroy records investigators need; in an organization, follow your responder's instructions. Then report to the police or your national cybercrime reporting channel, and if personal data may have leaked, check your data-protection reporting duties. Get expert advice before paying or contacting the attackers.

QIs there a free way to decrypt the files?

For some families, yes. The No More Ransom project, started in 2016 by the Dutch police, Europol and security companies, publishes free decryption tools for ransomware families that can be decrypted. Many newer families can't be decrypted, though, so the most reliable way back is restoring from an offline backup.