Security Malware and cleanup: when a device starts misbehaving
Ransomware explained: how it gets in and what to do first
How a ransomware attack unfolds on a home or small business machine, why paying is a poor bet, and the backup arrangement that makes the whole thing survivable.
The short answer
- Ransomware is the last step of an intrusion that usually began days or weeks earlier with a stolen password or an unpatched internet facing service.
- Attackers destroy or encrypt backups before they encrypt your files, so a backup that is connected and writable when the attack runs is not a backup.
- Data is normally copied out before encryption, which makes a ransomware attack a data breach as well as an outage.
- Paying buys a slow and partial decryption tool, does not un-copy stolen data, and still leaves you rebuilding the machines.
- Isolate the machines but do not wipe them immediately, because the ransom note and a sample file are what identify the strain and whether a free decryptor exists.
- The prevention that works is unglamorous: offline or immutable backups, multi factor sign in on remote access, and patching what faces the internet.
Ransomware is an attack that takes your files hostage, and on most home and small business machines it is the last step of something that started days or weeks earlier. Someone gets in using a stolen password or an unpatched service, looks around quietly, deletes or encrypts the backups first, copies data worth threatening you with, and only then runs the encryption and leaves a note. That order explains almost everything about how to respond. It is why backups are the whole game, why paying is a poor bet, and why the useful question after an attack is not how to decrypt the files but how quickly you can rebuild from copies the attacker could not reach.
How an attack actually unfolds
The image of a single bad email attachment that instantly locks everything is out of date. The pattern on business networks, and increasingly on well connected home setups, runs in stages.
- Access. Usually stolen or guessed credentials on something reachable from the internet: a remote desktop connection, a VPN appliance, a management console. Otherwise an unpatched vulnerability in that same kind of edge device, or a loader delivered by a phishing message or a fake software download.
- Quiet time. Hours to weeks of looking around, escalating privileges, and finding out where the file shares and the backups live. Nothing appears broken during this period.
- Backup destruction. Backup jobs get deleted, backup servers get encrypted, cloud sync is used to overwrite good files with bad ones, and on Windows the shadow copies that power previous versions are removed. This is deliberate and it happens before the noisy part.
- Data theft. Files are copied out so there is leverage even if you restore perfectly.
- Encryption and the note. Files are rewritten with new extensions, a note appears in every folder, and a deadline is attached, often with a threat to publish what was taken.
Two consequences follow. A backup that is connected and writable when the attack happens is not a backup. And because data was copied out before encryption, an attack is also a data breach, with the reporting obligations described in what a data breach means for you.
The first hour
- Isolate, do not wipe. Unplug the network cable and turn off wifi on affected machines. Disconnect external drives. If files are actively being encrypted, powering off limits the damage, and on balance that is the right call for a home machine.
- Preserve what you have. Photograph the ransom note and a folder of encrypted files. Keep a copy of the note file and one small encrypted file. Do not reinstall yet, because those two files are what identifies the strain.
- Check the other devices. Anything sharing the same network, the same cloud sync folder, or the same accounts. Pause cloud sync immediately so encrypted versions stop propagating, then check whether the service keeps file version history.
- Identify the strain. Free identification services run by law enforcement and security vendors, the best known being the No More Ransom project, match a note and a sample file against known families and tell you whether a free decryptor exists. It often does for older strains, and never for current ones.
- Report it. In the US, the FBI internet crime complaint center and, for businesses, the national cyber agency. In the UK, Action Fraud alongside the national cyber security center. In the EU, your national police, plus your data protection authority within 72 hours if personal data was involved. This is general information rather than advice for your specific situation, and for a business it is worth a call to your insurer and a lawyer early.
- Change passwords from a clean device. Assume the credentials on the affected machines are known.
Should you pay
Treat payment as a last resort with a poor expected outcome rather than a transaction with a service provider. Several things are true at once, and they are unpleasant.
Paying buys a decryption tool, not your situation back. Those tools are typically slow, sometimes buggy, and often fail on some portion of the files, especially large databases. You still have to rebuild the machines, because a system that was fully controlled by someone else cannot be trusted afterwards, so the cleanup described in the step by step cleanup for an infected computer happens either way.
Paying does not un-copy stolen data. Once files are on someone else's server, a promise to delete them is worth nothing, and groups have gone back for a second demand after being paid. Payment also marks you as someone who pays.
There are legal angles too. In the US, paying a group under sanctions can itself breach sanctions rules, and payments are usually handled through specialist negotiators and reported to the authorities. In the UK and the EU there is no general ban on paying, but insurers, regulators and the police all expect to be involved. Again, general information rather than advice for your specific case.
The argument for paying is narrow: no usable backups, the data is genuinely irreplaceable, and the business ends without it. If that is your position, you have learned something important about the backups, and the fix belongs in the calm period after the incident rather than the panic during it.
Recovering without paying
Rebuild rather than clean, and rebuild in an order that does not reinfect you.
Start with how they got in, because restoring onto the same open door produces a repeat within days. Close the exposed remote access, apply the patches, reset every account password including service accounts, and disable accounts you do not recognize. Then reinstall the operating system on affected machines from clean installation media rather than trusting a cleanup. Restore data from the most recent backup that predates the intrusion, not merely the encryption, which is why versioned backups matter more than a single latest copy. Scan restored files before putting them back in general use, then watch for a couple of weeks.
Check the easy wins before assuming files are gone: cloud storage version history, a phone that still holds the original photos, email attachments, and an external drive that happened to be unplugged that day. Encrypted files are worth keeping on a cheap external drive rather than deleting, since decryptors are sometimes published later when a group collapses or keys leak.
The backup arrangement that actually survives this
| Backup type | Survives a normal disaster | Survives ransomware | Why |
|---|---|---|---|
| External drive left plugged in | Yes | No | Encrypted along with everything else |
| Cloud sync folder | Partly | No, unless it keeps versions | Bad files sync over good ones |
| External drive unplugged between backups | Yes | Yes | Offline when the attack runs |
| Backup service with versioning and retention | Yes | Usually | Old versions can be restored |
| Immutable or write once storage | Yes | Yes | Cannot be altered until retention expires, even with admin rights |
| Backup server on the same domain | Yes | No | Same credentials reach it |
The pattern that works is three copies of the data, on two kinds of media, with one offline or immutable, and it is set out in practical terms in the 3-2-1 rule in real life. The word that carries the weight is offline. A copy an attacker with your administrator password cannot reach or delete is the difference between a bad week and a closed business.
Then test a restore. An untested backup is a belief, not a plan. Restore a folder and a whole machine once, note how long it took, and you will know what a real incident costs in hours.
What to set up this week
Three things prevent most of what is described above. Put multi factor sign in on every remote access path and every administrator account, since stolen passwords are the most common way in and a second factor blocks the reuse. Apply updates to anything facing the internet first, especially routers, firewalls and remote access appliances. And arrange one backup that is offline or immutable, then verify it restores.
After that, tidy the edges. Turn off remote desktop access from the internet unless you truly need it, use unique passwords so one leaked password does not open several doors, and keep an eye on what your machines are actually running, which is easier once you understand the different families of malicious software. If you are already in the middle of an attack, work the first hour list above, then rebuild rather than clean.
Common questions
If I pay the ransom, will I get my files back?
Usually you receive a working decryption tool, because groups that never deliver stop getting paid. That is not the same as getting your situation back. The tools are slow, they commonly fail on a portion of files, you still have to rebuild machines that someone else controlled, and any data copied out before encryption stays copied. Payment is a last resort, not a recovery plan.
Can encrypted files be decrypted for free?
Sometimes. Free decryptors exist for older families where keys leaked or a group was taken down, and identification services run by law enforcement and security vendors will tell you whether yours is one of them. Current strains use encryption that cannot be broken. Keep the encrypted files on a cheap drive anyway, since decryptors are occasionally published long after the event.
Does cloud storage protect me from ransomware?
Only if it keeps version history and you know how to use it. Plain sync does the opposite: encrypted files replace good ones everywhere within minutes. Check whether your service retains previous versions, how far back, and whether deleted files are recoverable. Pause syncing the moment you suspect an attack, then restore from versions rather than from the current state.
How does ransomware get onto a small business network?
Most often through credentials on something reachable from the internet, such as remote desktop or a VPN login without a second factor, or through an unpatched vulnerability in that same equipment. Malicious attachments and fake software downloads still play a part as the initial foothold. The common thread is an entry point exposed to the internet that nobody was watching.
Should I report a ransomware attack to the police?
Yes, and it costs you little. Reports feed the work that produces free decryptors and takedowns, and in many countries a report is expected by insurers. In the US that means the FBI complaint center, in the UK Action Fraud, and elsewhere your national police. If personal data was taken, data protection law in the EU and the UK adds a notification deadline for the regulator.