At 9:40 on a Tuesday morning, the shared drive at a five-person accountancy firm stops opening. Spreadsheets and client letters turn into files with unfamiliar extensions. A text document appears on the desktop with a countdown and a payment address. As far as anyone can remember, nobody clicked anything strange. That is how ransomware usually arrives — quietly, and often on an ordinary working day.
Ransomware is malicious software that locks your files by encrypting them, then demands money for the key. It reaches home laptops, freelance workstations, clinics, charities and large companies alike. Understanding the paths it takes, and preparing before it arrives, is what separates a bad afternoon from a lost year of work.
What Ransomware Actually Does
The core trick is encryption. Modern ransomware scrambles documents, photos, spreadsheets, databases and sometimes entire virtual machines in minutes, then leaves a note explaining how to pay. Because strong encryption cannot realistically be reversed without the key, recovery without a backup means either paying or rebuilding from scratch.
Many campaigns now steal data before encrypting it. The attackers copy your files out, then threaten to publish them if you refuse to pay — a tactic sometimes called double extortion. This matters for two reasons. First, it makes "we have nothing sensitive" a weak defence. Second, even a successful restore from backup may leave you with a data-leak problem to manage.
How Ransomware Gets In
There is no single doorway, but most infections start in one of a handful of places.
- Phishing emails. An urgent invoice, a delivery problem, a scanned document, a shared file notification. The attachment or link looks plausible because the sender's address or branding has been spoofed, or because a legitimate mailbox was already compromised.
- Malicious downloads. Cracked software, fake installers, "free" versions of paid tools, and pop-ups pretending to be browser updates.
- Exposed remote access. Remote Desktop Protocol, remote support tools and admin panels left reachable from the internet with weak passwords and no second factor. Attackers scan for these constantly; it takes no cleverness to find them.
- Unpatched software and devices. A router, VPN appliance, content management plugin or operating system missing security updates is an open window.
- Removable media and shared folders. An infected USB stick, or a shared drive where one unlocked machine can reach everything else.
- Trusted connections. A supplier, contractor or IT provider with access to your systems gets hit, and the infection travels along the permissions you granted.
Notice the pattern: a human moment — tired, rushed, curious — combined with a missing control. That is why defences focus on both habits and technical limits.
Warning signs worth acting on
Slow file access across many folders, antivirus alerts that keep reappearing, files renaming themselves, or unexpected admin accounts appearing are all reasons to stop and check. Disconnecting a machine at the first odd signal costs you ten minutes. Waiting costs you the network.
Why Backups Decide the Outcome
Everything else is damage limitation. A working backup is the difference between restoring files over a weekend and losing them permanently.
Three copies of your important data, on two different kinds of storage, with one copy kept offline or offsite. Then prove it works.
A few practical details separate real backups from comforting ones:
- Keep a copy disconnected. Ransomware hunts for connected external drives, mapped network drives and synced cloud folders. Unplug the drive when the backup finishes.
- Use versioning or immutability. Cloud backup services with version history let you roll back to a date before the infection. Immutable storage cannot be altered or deleted, even by an attacker with your credentials.
- Mind the timing. If you notice an infection three days late and your only backup runs nightly, that backup may already contain encrypted files.
- Test a restore. Pick one file, recover it to a clean machine, and open it. An untested backup is a hope, not a plan.
- Protect the credentials. Backups reachable from the same account you use for email are only as safe as that account. Use a separate, well-protected login.
If a Device Is Infected: What to Do First
- Disconnect it from the network. Unplug the ethernet cable and switch off Wi-Fi. This limits how far the infection can spread.
- Leave the files alone. Do not delete, rename or "clean up" encrypted files, and do not run random decryption tools found online. Note or photograph the ransom note and any error messages.
- Check the rest of your devices. Look at shared folders, external drives and cloud sync. Pause syncing so encrypted files do not overwrite your clean cloud copies.
- Tell the people who need to know. Colleagues, your IT contact, and your bank if payment details may be exposed. Report the incident to your national cybercrime unit or police; in Italy this is the Polizia Postale. Speed matters more than neatness here.
- Change passwords from a different, clean device — email first, then banking and any account tied to the affected machine. Turn on two-factor authentication as you go.
- Rebuild before restoring. Wipe and reinstall the operating system, or use a known-good machine, then restore from backup. Restoring onto an infected system risks re-encryption.
Should You Pay?
Paying is a gamble. You may receive a broken decryption tool, a partial key, or nothing at all, and you fund the next attack. It also marks you as someone who pays. If client data, contracts or regulatory duties are involved, speak to a lawyer, your insurer and an incident-response professional before making any decision — and keep the decision away from whoever is feeling the pressure most.
Everyday Habits That Keep Ransomware Out
Install updates promptly, including on your router and phone. Use a password manager and two-factor authentication, especially on email and remote access. Turn off remote desktop access that you do not genuinely need, and never expose it directly to the internet. Disable macros in office documents unless a file is trusted. Give people the lowest level of access they need, and remove accounts when someone leaves. If you run a small business, write down what you would do in the first hour of an incident, including who calls whom.
A Ten-Minute Check You Can Do This Week
Open your backup settings and answer five questions: where do my copies live, when did the last successful one finish, is at least one copy offline or immutable, can I restore a single file today, and who would I call first if a screen full of ransom notes appeared? If any answer is vague, fix that one thing now. Ransomware punishes the unprepared, but it rarely beats someone with a tested backup and a clear first move.
Photo: Jakub Zerdzicki / Pexels
