What Is Ransomware (and How Does It Actually Get In)?

Quick answer

• Ransomware is malware that encrypts your data and demands payment for the key.
• It rarely “hacks in” via exotic exploits; it usually enters through phishing, stolen credentials, or unpatched systems.
• The two best defenses are offline backups and phishing-resistant authentication — not paying the ransom.

What is ransomware?

Ransomware is malicious software that encrypts a victim’s files or systems and demands a ransom — typically cryptocurrency — in exchange for the decryption key. Some variants also threaten to publish stolen data (“double extortion”). It has become the most financially damaging category of cybercrime because it monetizes a victim’s entire operation at once.

How it actually gets in

Ransomware is a payload, not an entry method — it arrives through the same channels as any malware. The dominant vectors are phishing (a convincing email leads someone to open an attachment or enter credentials), stolen or weak credentials (especially exposed remote-access logins), and unpatched vulnerabilities (known flaws with available fixes). Attackers then move through the network, locate backups, and encrypt everything at once.

How to defend

The single most important control is offline, tested backups — a copy of your data the attacker can’t reach or encrypt, which turns “pay the ransom” into “restore and move on.” Pair that with phishing-resistant MFA, patching, and least-privilege access so an entry point can’t become a full-network encryption event.

Where this bites vibecoders

The pattern that matters: an app with no offline backups, an admin account with a reused password, and a database reachable from everywhere. That’s a ransomware operator’s ideal target, and it’s exactly the default state of many AI-assembled projects. The fix is boring but decisive — separate backups the app can’t write to, and MFA on anything that can reach production.

Where AI coding assistants get this wrong

• Setting up backups that live on the same machine (or same account) as the data.
• Leaving admin or remote-access surfaces exposed with password-only auth.
• Ignoring patching guidance for the stack it generated.

Checklist

• Keep offline, immutable backups and test restoration.
• Enforce phishing-resistant MFA on administrative access.
• Patch systems on a regular cadence.
• Apply least privilege so one account can’t encrypt everything.
• Rehearse recovery: know how long restore takes, not just that it works.

FAQ

Should you pay the ransom?

Law enforcement and most experts advise against it: payment funds further crime and doesn’t guarantee the key works. The reliable path is prevention and tested backups, which make payment unnecessary.

What is double extortion?

In double extortion, attackers both encrypt data and steal a copy, threatening to publish it if the ransom isn’t paid. This raises the stakes beyond data loss to data exposure, which is why encryption of sensitive data at rest also matters.

Is ransomware targeted or opportunistic?

Both. Many attacks are opportunistic — scanning for exposed logins and unpatched systems — while high-value targets get deliberate, tailored attacks. The opportunistic ones are the easiest to prevent with basic hygiene.

Related topics

• How to Set Up Automated Database Backups
• What Is Phishing-Resistant MFA?
• What Is Zero Trust Architecture?

Sources

• CISA — Stop Ransomware
• NIST — Ransomware guidance