Ransomware encrypts your files and demands payment to unlock them
Ransomware is malware that locks or encrypts your files, then displays a message demanding you pay money—usually in cryptocurrency like Bitcoin—to restore access. The attacker holds your data hostage until you send payment. Once installed, ransomware can spread through your entire computer or network, affecting documents, photos, databases, and system files you need to work.
Ransomware typically arrives through phishing emails with malicious attachments, compromised websites, unpatched software vulnerabilities, or weak passwords on remote access tools. It encrypts files so thoroughly that you cannot open them without the decryption key, which only the attacker possesses. Some variants also threaten to publish your data publicly if you do not pay, adding pressure to comply.
The payment demand usually appears as a pop-up or text file on your screen, with instructions for sending money. Attackers often set a deadline to create urgency, though these deadlines are rarely enforced. Paying does not may provide you will recover your files—some attackers disappear after receiving payment, and others use the transaction to identify victims for follow-up attacks.
Key Takeaways
- Ransomware encrypts your files and displays a ransom note demanding payment in Bitcoin or another cryptocurrency to restore access.
- Most ransomware arrives through phishing emails, malicious downloads, or exploits of unpatched software vulnerabilities.
- Paying the ransom does not may provide file recovery and may mark you as a target for future attacks.
- Disconnecting the infected device from the network immediately can prevent the malware from spreading to other computers or backups.
- Restoring from a clean backup is the most reliable way to recover files without paying, provided the backup was made before infection.
How ransomware spreads and infects your system
Phishing emails are the most common entry point. An attacker sends an email that looks like it comes from a trusted source—your bank, your employer, a delivery service—with an attachment or link. When you open the attachment or click the link, the malware downloads and runs silently in the background. The email might claim you have an unpaid invoice, a package waiting, or a security alert that requires immediate action.
Ransomware also spreads through compromised websites, especially if your browser or plugins are outdated. Visiting an infected site can trigger an automatic download without any action on your part. Weak passwords on remote access tools like RDP (Remote Desktop Protocol) allow attackers to log in directly and install ransomware manually. Unpatched software—Windows, Adobe Reader, Java—leaves known security holes that ransomware exploits to gain entry.
Once inside, ransomware scans your hard drive and network for files to encrypt. It typically targets documents, spreadsheets, images, databases, and backups. Some variants spread to network drives and shared folders, affecting multiple users at once. The encryption happens quickly, often within minutes, and by the time you notice something is wrong, most of your files are already locked.
What happens when ransomware locks your files
When ransomware encrypts a file, it becomes unreadable without the correct decryption key. You cannot open the file, copy it, or recover it using standard recovery tools. The malware typically changes the file extension—for example, a document named "report.docx" might become "report.docx.locked" or "report.docx.encrypted"—so you can see at a glance which files are affected.
The ransom note appears on your screen, usually as a pop-up window or a text file placed on your desktop. It explains that your files are encrypted and provides instructions for paying the ransom, often with a countdown timer to create pressure. The note typically includes a link to a dark web payment site where you can send Bitcoin or another untraceable currency. Some notes offer a "free decryption test" where you can send one small file to prove the attacker can unlock it.
The attacker may also threaten to sell or publish your files if you do not pay within a certain timeframe. This double-extortion tactic is common in recent ransomware variants and adds another layer of pressure. However, these threats are often empty—attackers may not actually have copies of your data, or they may publish it regardless of whether you pay.
Why paying the ransom is risky and often ineffective
Paying does not may provide you will recover your files. Some attackers disappear after receiving payment without sending the decryption key. Others send a key that does not work or only partially restores your files. There is no recourse if the attacker fails to deliver—you cannot dispute the transaction or get your money back, since cryptocurrency payments are irreversible.
Paying also marks you as a victim willing to negotiate. Attackers may target you again with a different ransomware variant, or sell your information to other criminals. Your payment funds criminal operations and encourages more attacks on other individuals and organizations. Some countries have sanctions against paying ransoms to certain groups, which could expose you to legal liability depending on who carried out the attack.
Law enforcement agencies, including the FBI and CISA (Cybersecurity and Infrastructure Security Agency), recommend against paying ransoms. They note that payment does not stop the threat and often leads to repeat victimization. If you are a business, paying may also violate insurance policies or regulatory requirements.
Immediate steps to take if your files are locked
Disconnect the infected device from the network and the internet immediately. Unplug the ethernet cable or turn off Wi-Fi to prevent the malware from spreading to other computers, network drives, or cloud backups. Do not shut down the computer unless instructed to do so by a professional—some ransomware variants trigger additional damage on shutdown.
Do not pay the ransom or contact the attacker. Do not open any files or run any programs on the infected device. Do not attempt to decrypt files yourself using online tools, which may cause further damage or expose you to additional malware.
Contact a cybersecurity professional or your IT department if you have one. They can identify which ransomware variant infected your system and determine whether a free decryption tool is available. Some ransomware variants have known weaknesses, and security researchers have published free decryption tools for older strains. Websites like No More Ransom (nomoreransom.org) maintain a database of free decryption tools organized by ransomware family.
Report the attack to law enforcement. In the United States, you can report to the FBI's Internet Crime Complaint Center (IC3) at ic3.gov or contact your local FBI field office. Reporting helps authorities track ransomware campaigns and may lead to the arrest of the attackers. Keep all evidence—the ransom note, screenshots, email headers if the attack came via email—for the report.
Recovering files from backups without paying
If you have a backup made before the infection, you can restore your files without paying. Check external hard drives, network-attached storage (NAS) devices, or cloud backup services like Google Drive, OneDrive, or Backblaze. Restore the backup to a clean device or a freshly formatted hard drive to ensure you do not restore the malware along with your files.
Some ransomware variants target backups as well, encrypting files on external drives or cloud storage. If your backup is also encrypted, you may need to restore from an older backup or use file recovery software on the backup device itself. This is why security experts recommend keeping at least one backup disconnected from your network at all times—an offline backup cannot be encrypted by ransomware.
Restoration from backup typically takes hours or days depending on the size of your data and the speed of your backup system. During this time, you will not have access to your files, but you will recover them without paying and without supporting criminal activity.
Protecting yourself from ransomware in the future
Keep your operating system and all software updated. Ransomware exploits known vulnerabilities in Windows, browsers, Adobe Reader, Java, and other programs. Enable automatic updates so patches are installed as soon as they are released. Uninstall software you no longer use, especially older versions of Java and Flash, which are common attack vectors.
Use strong, unique passwords for all accounts, especially email and remote access tools like RDP. A strong password is at least 16 characters long and includes uppercase letters, lowercase letters, numbers, and symbols. Consider using a password manager like Bitwarden or 1Password to generate and store passwords securely. Enable multi-factor authentication (MFA) on email and any accounts that support it.
Be cautious with email attachments and links. Do not open attachments from unknown senders. Hover over links to see the actual URL before clicking. If an email claims to be from your bank or a service you use, log in directly through the official website or app rather than clicking a link in the email. Train yourself and anyone who uses your computer to recognize phishing attempts.
Install and maintain antivirus or anti-malware software. Windows Defender (built into Windows) provides basic protection, but third-party tools like Malwarebytes offer more advanced detection. Keep these tools updated and run regular scans. However, no antivirus is 100 percent effective, so backups and good security practices are equally important.
Back up your files regularly to an external drive or cloud service, and keep at least one backup disconnected from your network. Test your backups periodically to ensure they can actually be restored. A backup that cannot be restored is useless if ransomware strikes.
Frequently Asked Questions
Can ransomware infect my phone or tablet?
Yes, but it is less common than on computers. Mobile ransomware typically locks your screen or encrypts files on your device. The best protection is to keep your phone updated, avoid downloading apps from untrusted sources, and use a reputable mobile antivirus app. If your phone is infected, restart it in safe mode and remove the suspicious app, or factory reset the device if the infection persists.
What if I cannot find a free decryption tool for my ransomware?
If no free tool exists and you have no backup, your options are limited. You can attempt file recovery using software like EaseUS or Recuva, though this works only if the ransomware did not securely overwrite the original files. Otherwise, you may need to accept the loss of those files. Some organizations negotiate with attackers through a third party, but this is risky and not recommended for individuals.
Will my antivirus catch ransomware before it encrypts my files?
Antivirus software can catch known ransomware variants, but new variants and zero-day exploits may slip through. Antivirus is one layer of protection, not a complete solution. Backups, software updates, strong passwords, and careful email habits are equally important for preventing infection.
Is it safe to use the free decryption test the attacker offers?
It is generally safe to send one small file to a decryption service to verify the attacker can unlock it, since the test file is already encrypted and cannot be harmed further. However, this also confirms to the attacker that your email address is active and you are considering payment, which may lead to follow-up extortion attempts. Proceed only if you are seriously considering paying, and consult a professional first.
What should I do if a business I work for is hit by ransomware?
Report it to your IT department or security team immediately. Do not attempt to fix it yourself or pay the ransom without authorization. Your employer may have cyber insurance, incident response procedures, and legal obligations to report the attack to authorities and affected customers. Follow your company's incident response plan and preserve all evidence for law enforcement and insurance purposes.