Ransomware is malware that pressures a victim to pay by denying access to data or threatening to disclose it. Understanding its basic operation helps explain why prevention, reliable backups, and careful incident response matter.
Ransomware is malware that holds data or access to a system hostage until a ransom is demanded. Some attacks encrypt files; others restrict access to the device, steal information, or combine these tactics. In double extortion, attackers both encrypt data and threaten to publish stolen copies.
All flashcards
What is ransomware?
Malware used for extortion by restricting access to a system or data, encrypting files, or threatening to disclose stolen information in exchange for a ransom.
What is hybrid encryption in ransomware?
The malware encrypts files with a symmetric key, then encrypts that key with the attacker’s public key. The attacker keeps the corresponding private key.
What is the role of the symmetric key?
It efficiently encrypts the victim’s data. The key is needed to decrypt the affected files.
What is double extortion?
A tactic in which attackers encrypt data and also threaten to publish stolen information.
Does paying guarantee recovery?
No. The attacker may fail to provide a working key, and payment does not ensure that stolen data will remain private.
Quiz questions
In hybrid ransomware encryption, how are files and the symmetric key typically protected?Answer: A symmetric key encrypts the files, and the attacker’s public key encrypts that symmetric key.
What distinguishes leakware from ransomware that only encrypts files?Answer: Leakware steals sensitive information and threatens to publish it.
What is ransomware-as-a-service (RaaS)?Answer: A model in which operators provide ransomware tools or operations to affiliates for a share of proceeds.
What did WannaCry demonstrate about ransomware propagation?Answer: Ransomware can spread automatically between vulnerable computers without each victim opening an attachment.
Why do good backups not fully protect an organization from ransomware extortion?Answer: Backups can help restore files, but they cannot prevent attackers from disclosing stolen data.
Based on the Wikipedia article Ransomware, licensed CC BY-SA 4.0. Adapted into a summary, flashcards and quizzes.