What Is Ransomware: How Human-Operated Attacks Work and How to Defend Against Them

Ransomware, in practical terms, refers to attacks that take files or device access hostage and demand ransom in exchange for a decryption key. Microsoft notes that even when a ransom is paid, victims may not receive a working decryption key and there is a risk that access will be permanently lost.

Human-operated ransomware attacks typically follow stages including initial access, persistence and detection avoidance, lateral movement, credential theft, data exfiltration, and impact. Attackers reconnoiter weaknesses in the target environment to establish a foothold, then use stolen credentials to escalate privileges and reach critical assets. These attacks target organizations as a whole rather than single endpoints and can potentially inflict catastrophic damage to business continuity.

Microsoft cites products such as Defender XDR, Microsoft Sentinel, and Security Copilot, explaining that machine learning and automation are used to detect and block attacks early and to assist incident response. For ongoing attacks, Microsoft Incident Response outlines procedures that use Defender for Identity and Defender for Endpoint to help determine the scope of compromise, evict threat actors, and protect impacted accounts and assets.

The company also calls out malware families such as Qakbot, Ryuk, and Trickbot, and threat actors including LockBit, Black Basta, and Storm-1674. It references ransomware variants observed from late 2024 into 2025—Akira, FOG, Qilin, Lynx, RansomHub, BlackBasta, SafePay, Hellcat, and others. For automated “commodity” attacks, Microsoft recommends protecting email and endpoints with Defender for Office 365 and Defender for Endpoint.

As initial response steps for organizations, Microsoft recommends recording the time of discovery and reviewing logs, checking which business applications and backups are affected and available, and pursuing full threat actor removal (compromise recovery). It also provides separate documentation on defenses specific to Azure.