In one sentence: Ransomware is malicious software that locks your files or systems, and often steals your data, then demands payment to give them back.

What it is

The NCSC defines ransomware as a type of malware that prevents you from accessing your device and the data stored on it, usually by encrypting your files. A criminal group then demands a ransom in exchange for decryption.

The NCSC adds that systems may be locked, or data stolen, deleted or encrypted, and that some ransomware spreads to other machines on the network. Attackers will also threaten to publish stolen data if payment is not made. The NCSC and the National Crime Agency call ransomware the most significant, serious and organised cyber crime threat faced by the UK.

How it works

1. Initial access. The NCSC says most incidents are not due to sophisticated techniques. Access is usually opportunistic and the result of poor cyber hygiene, such as unpatched devices, weak passwords and missing MFA. Criminals scan the internet for exposed devices such as Exchange servers, VPNs and firewalls.
2. Spreading. The attacker explores the network and gains higher privileges.
3. Data theft. Data is copied out so it can be used as extra pressure.
4. Encryption. Files and sometimes backups are encrypted or destroyed, and a ransom note appears.
5. The demand. Victims are told to contact the criminals, often through anonymous channels.

The NCSC warns that paying gives no guarantee of getting data back, and that occasionally malware presented as ransomware is actually a wiper that destroys files.

Who it affects and how badly

Every sector and size. The NCSC and NCA note that criminals look for devices likely to be in businesses, and that you can be hit as collateral damage even if not targeted.

Up to 10 staff: no access to files, invoicing or email for days. 10 to 50 staff, such as accountancy, legal and construction firms: client work stops and data may be stolen. 50 to 250 staff, such as manufacturers and care providers: production or care records unavailable. Schools, charities and councils: services and personal data affected. Regulated firms: fines, breach reports and lost clients on top of downtime. The NCSC says recovery can take several weeks and reputation longer.

Real examples

WannaCry and the NHS, 2017. The National Audit Office found at least 81 of 236 NHS trusts in England were affected, plus 603 primary care and other organisations including 595 GP practices. All infected organisations had unpatched or unsupported Windows systems. No NHS organisation paid the ransom. Source: https://www.nao.org.uk/reports/investigation-wannacry-cyber-attack-and-the-nhs/

British Library, October 2023. The Library’s own review says the attack, claimed by the Rhysida ransomware gang, exfiltrated data, encrypted or destroyed substantial portions of its server estate and locked out all users. Sources: https://www.bl.uk/stories/blogs/posts/learning-lessons-from-the-cyber-attack and https://cdn.sanity.io/files/v5dwkion/production/99206a2d1e9f07b35712b78f7d75fbb09560c08d.pdf

How to detect it

• Watch for mass file renames or new extensions, ransom notes in folders, and sudden slow file servers.
• Alert on backups or shadow copies being deleted or changed, new admin accounts and unusual VPN logins. CISA lists these as hunting leads.
• In Microsoft Defender and most endpoint tools, enable ransomware and tamper protection alerts. Review sign-in logs for logins from new locations.
• Monitor for large outbound transfers, which can signal data theft before encryption.
• Subscribe to the NCSC’s free malicious activity notifications for UK organisations.

How to fix or prevent it

1. Keep recent offline backups and test restoring them. The NCSC says always have a recent offline backup of important files.
2. Turn on MFA everywhere, especially for remote access and admin accounts.
3. Patch internet-facing systems quickly, and remove or protect devices that cannot be patched.
4. Limit admin rights and segment the network to slow spread.
5. Filter email and block malicious attachments.
6. Collect logs and watch for early signs.
7. Write and rehearse an incident plan, including who calls whom. The NCSC provides a free Exercise in a Box.
8. Do not assume payment fixes it. The NCSC and law enforcement do not encourage payment.

Related terms

• double extortion
• ransomware as a service
• initial access brokers
• offline and immutable backups
• ransomware recovery
• trojan
• phishing
• indicators of compromise
• infostealer malware

Browse the full Resources library.

FAQ

Should we pay the ransom? The NCSC and UK law enforcement do not encourage, endorse or condone payment, and paying gives no guarantee you get your data.

How does ransomware get in? The NCSC says usually through poor cyber hygiene such as unpatched devices, weak passwords and no MFA.

What is the best protection? Recent offline backups plus MFA, patching and monitoring, according to the NCSC guidance.

How Wolfcore helps

Wolfcore’s ransomware readiness assessment shows how far an attacker would get and what you would lose, and our SOC monitoring keeps watch after the test. See Wolfcore pricing.