What Is Ransomware: How It Works and How to Defend Against It

According to Fortinet’s explanation, ransomware is a type of malware that takes an individual’s or organization’s data “hostage” and demands a ransom in exchange for recovery. Its history goes back to the 1980s AIDS Trojan, and the spread of cryptocurrencies—making ransom payment easier—has been cited as one factor in its proliferation.

The typical attack lifecycle is described in six stages: reconnaissance, infection, privilege escalation, network scanning (lateral movement), encryption, and ransom demand. Common intrusion vectors include phishing, malicious attachments (malspam), drive-by downloads, and malvertising, with social engineering playing an important role.

Ransomware variants include screen lockers, encryptors (crypto-ransomware), doxware/leakware that threaten data exposure, and scareware aimed at extortion; recently, service models such as RaaS (Ransomware-as-a-Service) have also emerged. Organizations most at risk include small and medium-sized businesses and industries with high downtime costs. To prevent damage, layered defenses are recommended, such as backups, endpoint protections like EDR, and employee training.

Reported trends show increasing impact: IBM’s 2024 analysis indicates 67% of healthcare organizations reported attacks and the average ransom exceeded $5.2 million. Other cited statistics show attack counts rose 16.7% in software development and 12.8% in healthcare from 2024 Q2 to Q3. Organizations should prioritize early detection of indicators, preparation of incident response plans, and deployment of up-to-date security measures.