Simple definition
One ransomware makes files unusable and requests money to try to recover them.
Technical definition
Attacks can include data theft, lateral displacement, deactivation of protections and massive encryption. Groups often perform double extorsion by also threatening to publish data.
What is it used for ?
Understanding this risk allows you to prepare backups, segmentation, EDR and incident response procedures.
Practical example
A compromised administrator account allows the attacker to deploy encryption to the domain servers and posts.
Common issues
- Also encrypted connected backups
- No logging
- Over-privileged accounts
- Late reaction after the first signals
Related terms
Key takeaway: This entry explains the general operation of the term. Exact settings may vary depending on software, vendors and environments.