Ransomware: How It Works, Major Attacks, and How to Recover Without Paying

What Is Ransomware

Ransomware is malicious software that encrypts user files to extort a ransom. An analogy: someone breaks into your house at night, changes all the locks, and leaves a note: "Want the new combination? Call this number and pay." You cannot open your files not because they are deleted, but because their contents have been scrambled by a mathematical algorithm; only someone with the specific decryption key can restore them.

How Ransomware Works

The process typically has three steps:

Step 1: Intrusion Ransomware enters your computer via:

Malicious attachments in phishing emails (most common)

Compromised websites

Automated exploitation of software vulnerabilities

Infected USB drives

Step 2: Encryption Once inside, the malware runs silently in the background, encrypting files one by one. Encrypted files receive strange extensions such as .locked, .crypted, or .wncry. Commonly targeted file types include:

Documents (Word, Excel, PDF)

Images (JPG, PNG)

Videos (MP4, AVI)

Archives (ZIP, RAR)

Database files

Step 3: Extortion After encryption completes, a ransom note appears on screen, typically:

Stating that files have been encrypted

Showing a countdown timer after which the ransom doubles

Providing a Bitcoin wallet address for payment

Sometimes offering a "free decryption of one or two small files" as proof of capability

Notable Ransomware Incidents

WannaCry (May 2017)

Exploited the NSA-leaked "EternalBlue" vulnerability

Infected 300,000+ computers across 150+ countries

Paralyzed the UK National Health Service (NHS), preventing hospitals from accessing patient records

Demanded $300–600 in Bitcoin

Petya/NotPetya (June 2017)

Masqueraded as ransomware but its real purpose was destruction , not profit

Initially targeted Ukrainian government and enterprises before spreading globally

Caused over $10 billion in economic damage, called "one of the most destructive cyberattacks in history"

CryptoLocker (2013)

Spread via email attachments

One of the first ransomware families to gain widespread attention

Threatened to destroy the decryption key if victims did not pay within 72 hours

What to Do If Infected

1. Do Not Pay the Ransom!

Payment does not guarantee file recovery

Payment encourages attackers to continue

Some ransomware lacks any decryption capability and simply disappears after taking the money

2. Disconnect from the Network Immediately

Unplug the Ethernet cable, turn off Wi‑Fi

Prevents the malware from spreading to other devices

3. Do Not Shut Down or Restart Right Away

Some ransomware keeps the encryption key in memory; a reboot loses it

But do not keep the system running indefinitely, or more files may be encrypted

4. Identify the Ransomware Variant

Photograph or record the ransom note and the encrypted file extensions

Visit the No More Ransom site ( noransom.hack233.com) to check for free decryption tools

5. Attempt Data Recovery

If you have backups, restore from them

If not, look for unencrypted remnants such as temporary files or items in the Recycle Bin

How to Prevent Ransomware

The Most Critical Defense: Regular Backups!

Follow the 3‑2‑1 rule : 3 copies of data, on 2 different media types, with 1 copy stored off‑site

Backup media must be kept offline (not permanently connected to the computer, otherwise backups get encrypted too)

Regularly test that backups can actually be restored

Additional Measures:

Keep operating systems and applications patched to close vulnerabilities

Do not open email attachments from unknown or suspicious sources

Use reputable antivirus software and keep it updated

Enable Windows File History or System Restore

Certification Exam Points (软考)

Definition and working principle of ransomware

Propagation vectors and encryption mechanisms

Prevention measures: importance of backups, the 3‑2‑1 principle

Role of social engineering in distribution (phishing emails)

Summary

Ransomware is one of today's most destructive cyber threats. It holds your files hostage by encrypting them and demands payment for the key. The damage can be massive, but you can largely avoid falling victim by maintaining solid backups (remember the 3‑2‑1 rule), applying patches promptly, and avoiding suspicious links. Remember one rule: Backups are your last line of defense—don't wait until after a ransomware attack to regret not having them.