A staff member at a small logistics company opens an email that looks like a supplier invoice. The attachment is a password-protected ZIP, and the password is helpfully printed in the message. Ten minutes later, shared folders start vanishing from the network. By early afternoon, every screen shows a note demanding payment.
That is what most ransomware cases look like. There is no mastermind in a hoodie, just an ordinary workday and one decision made too quickly. Knowing the mechanics will not make you immune, but it will make the panic survivable and the next few hours much clearer.
What Ransomware Actually Does
Ransomware is malicious software that scrambles your files and sells you the key. The modern version is more patient than the old version. Intruders often break in days or weeks before the encryption starts, quietly mapping the network, stealing data, and hunting for backups. The ransom note is the last step, not the first.
That timing matters. If someone has been inside your network for a week, cleaning one laptop and moving on is not a fix.
The Three Doors Most Infections Come Through
Nearly every case traces back to a person, a password, or a flaw in software. Figure out which door is most likely yours, and you know where to spend your attention.
Phishing and other tricks aimed at people
Phishing relies on a moment of haste. The email is usually plausible and slightly urgent: an unpaid invoice, a shared document from a colleague, a delivery notice, a "voicemail" you cannot quite hear. A few common shapes:
- An HTML or ZIP attachment that opens a fake login page or runs a script.
- A link to a page that copies your real sign-in screen almost perfectly.
- A flood of push notifications or login prompts hoping you approve one.
- A message from a known contact whose mailbox was already compromised.
- A follow-up phone call from "support" after the email lands, asking you to install a remote tool.
Hover over links before clicking. If a message asks you to do something unusual, verify it through a phone number you already have, not the one in the email. And report suspicious mail instead of deleting it, so the next person gets a warning.
Exposed remote access and stolen passwords
Remote Desktop Protocol lets you control a Windows machine from somewhere else. When it sits directly on the internet, automated tools guess passwords around the clock. One weak or reused password and someone is inside, often without anyone clicking anything.
Credentials are also harvested in bulk by infostealer malware running on personal laptops, then sold and reused against company accounts. Watch for the telltale signs: successful sign-ins at strange hours, from countries you do not operate in, on accounts that are rarely used. Never expose remote desktop directly to the internet. Put it behind a VPN or an access gateway, require multi-factor authentication, limit who can connect and from where, and lock accounts after repeated failures.
Software and device exploits
Sometimes nobody is tricked at all. Attackers scan the internet for known vulnerable versions of VPN appliances, email servers, file-transfer tools, and website plugins, then use a published flaw to walk in. The fix is unglamorous: know what is on your network, patch internet-facing systems first, and replace hardware that no longer receives updates.
The First Hour: What to Do After an Infection
You will feel pressure to act fast. Act deliberately instead.
- Isolate the machine. Unplug the network cable and switch off Wi-Fi. In most cases leave the device powered on, since memory can hold useful evidence; follow your incident responder if they say otherwise.
- Photograph the ransom note. Do not click links or open any chat window in it.
- Do not pay as a reflex. Payment is no guarantee you get working files back, and it funds the next attack.
- Tell the right people. Your IT or security contact, leadership, your insurer, and outside counsel if customer or personal data may have been taken. Notification duties vary by country and industry, so get proper advice before deciding what to disclose.
- Reset passwords from a clean device, starting with email, because it is the reset key to everything else. Revoke active sessions too. Only do this once you are reasonably sure the intruder no longer has a foothold, or the new passwords can be captured as well.
- Check backups, but do not restore yet. Confirm you have copies dated before the intrusion, then wait until the environment is contained. Restoring into an infected network can simply re-encrypt everything.
- Write down what you know. What you saw, when, which machines, who did what. This record helps responders and may be required later.
Mistakes That Make It Worse
- Restoring from backup while the attacker still has access.
- Assuming one computer is the whole story.
- Reconnecting an infected machine "just to check something".
- Wiping drives before evidence is captured.
- Resetting passwords from the affected network.
- Staying quiet. Delay rarely helps, and reporting deadlines do not move.
Lowering the Odds Before You Need To
None of this is exotic, and none of it is a single product you can buy.
- Keep backups in three places, on two kinds of media, with one copy offline or offsite. Test a restore.
- Turn on multi-factor authentication for email, remote access, and admin accounts.
- Patch internet-facing systems on a schedule you can actually keep.
- Use separate admin accounts for admin work.
- Block macros from the internet, and remove local admin rights wherever possible.
- Run a short tabletop exercise once a year. It exposes assumptions faster than any document.
Write One Page and Keep It Offline
Before anything happens, put one page on paper: who to call, in what order, where the backups live and how to restore them, and who is allowed to decide that the network goes down. Print it. If the ransom note appears on your screen, the copy in your notes app is behind the same encryption.
Review that page once a year and after every close call. The goal is not to feel safe. It is to know exactly what you are doing during the worst hour of your week.
Photo: Bessi / Pixabay
