What is Ransomware?

Most modern ransomware is operated under a Ransomware-as-a-Service (RaaS) model: a core group builds and maintains the encryptor, leak site, and negotiation infrastructure, then leases it to affiliates who conduct the actual intrusions in exchange for a cut of any ransom paid. This division of labor means the intrusion phase, gaining initial access, escalating privileges, and moving laterally, can be carried out by different, sometimes unrelated affiliates using the same branded payload, which is why victim environments hit by the same named ransomware family can show very different initial-access techniques.

The typical lifecycle: initial access via phishing, an exposed RDP service, or exploitation of a known vulnerability; establishment of persistence and a foothold; credential harvesting and lateral movement, often using living-off-the-land tools like PsExec, WMI, or Cobalt Strike, to reach domain admin; discovery and staging of high-value data for exfiltration to give the extortion leverage; identification and disabling of backup systems specifically, since intact backups are the main thing that lets a victim refuse to pay; and finally, simultaneous deployment of the encryptor across as many hosts as possible, usually pushed via a compromised domain controller so it lands everywhere near-instantly.

Encryption itself typically uses a hybrid scheme: a fast symmetric algorithm (AES or ChaCha20) encrypts file contents in bulk, and the symmetric key for each file is itself encrypted with an attacker-held asymmetric key (RSA or similar) so only the attacker can unlock it. Immediately before or during encryption, the malware commonly runs vssadmin or wmic to delete Volume Shadow Copies, killing Windows' built-in local restore points, and attempts to stop backup agent processes and security software to reduce interference. Encrypted files get a new extension and a ransom note is dropped in every affected directory, sometimes replacing the desktop wallpaper as well. Defense layers accordingly: prevent initial access (phishing defense, patching internet-facing services, MFA on remote access), limit blast radius if access is gained (network segmentation, least privilege, tiered admin credentials so a workstation compromise cannot reach domain admin), protect backups (immutable, offline, or air-gapped copies the ransomware cannot reach or delete), and deploy EDR/XDR with behavioral detection tuned to catch mass file renaming and shadow copy deletion before significant encryption completes.