How does ransomware work? It gets onto a device or network, often through phishing or stolen credentials, encrypts files it can reach, then demands payment for decryption. How far it gets depends on what the first compromised account or device can reach.
The sections below follow the attack from delivery to payment demand and pair each stage with a defense. For the wider picture, start with how to protect yourself from hackers.
The attack lifecycle at a glance
Ransomware is not a single click. CISA describes it as malware designed to encrypt files on a device, rendering those files and the systems that depend on them unusable. Attackers then demand ransom in exchange for decryption. Between the first foothold and the demand sit several quiet stages, and each one is a chance to interrupt the attack.
| Stage | What the attacker does | Planning use |
|---|---|---|
| Delivery | Compromises the network with a phishing email, an exploit or a worm; stolen credentials and social engineering are the common entry routes CISA names | Concentrate prevention on the entry routes, as CISA’s guide does by grouping its prevention advice by initial access vector |
| Credential theft and spread | Steals credentials and gains access to more accounts across the network | Treat any single compromised account as a possible path to higher-value systems |
| Extortion | Exfiltrates and/or encrypts local and network files | Keep backups that the encrypted machines cannot reach |
| Demand | Asks for ransom in exchange for decryption, sometimes backed by a threat to release stolen data | Have a rehearsed incident response plan before the demand arrives |
Stage descriptions follow JPMorgan’s anatomy of a ransomware attack and CISA’s ransomware guide.
How ransomware gets in
Entry is usually the weakest part of the chain for attackers, because it relies on a person or an account rather than on technical brilliance. CISA’s guidance focuses on preventing common initial infection vectors, including compromised credentials and advanced forms of social engineering.
Phishing and social engineering
The typical installation route is a social engineering attack in which the user is tricked into clicking a phishing link or opening an attachment. If you want to recognize the lure before it works, read How Phishing Emails Work: A Clear, Practical Guide To Spot, Stop, And Survive Scams In 2026 – Cubeguard. Email awareness is the cheapest control at this stage, but it cannot be the only one, because a single successful lure is enough.
Stolen credentials and exploits
Delivery does not always need a victim to click anything. JPMorgan lists a phishing email, an exploit or a worm as ways the network gets compromised. CISA separately names compromised credentials as a leading infection vector. A valid login lets an attacker walk in rather than break in, which is why account protection belongs next to email defense.
Pop-ups and other channels
Acronis notes that ransomware can be distributed through malicious emails, targeted attacks, or even pop-up ads. A frightening pop-up is not proof of infection, but it can be part of the delivery attempt. If one appears on a phone, This “Your Phone Has Been Hacked” Pop‑Up Appeared — What To Do Now (2026 Guide) – Cubeguard covers the immediate steps.
What happens after the foothold
Once the malware is in, the attack shifts from delivery to preparation. According to KnowBe4, the malware “dials home” so the attacker can analyze what is valuable before anything is encrypted. JPMorgan reports it can take as little as three days for ransomware to infiltrate and infect systems, so the quiet period can be short.
Lateral movement
Lateral movement is the stage that turns a small incident into a large one. As the NHIMG community explains, it turns one compromised endpoint or credential into a pathway toward higher-value systems. Earlier ransomware strains spread like a worm through organizations, collecting credentials and encrypting files along the way. The practical implication is that no single laptop or login should be able to reach everything: the more an ordinary account can touch, the more a thief who steals it can encrypt.
Encryption and keys
When the attacker is ready, the malware will encrypt all data files it can find on the machine itself and on any network shares. Many campaigns use asymmetric encryption, a cryptography type that, per Acronis, relies on a pair of keys, with the attacker holding the private key needed for decryption. That is why guessing or brute-forcing your way back is not a realistic plan once files are locked.
Backups under attack
Backups are a target, not a bystander. CISA warns that many ransomware variants attempt to find and subsequently delete or encrypt accessible backups, and KnowBe4 adds that criminals now often corrupt backups before victims know what hit them. A backup that sits permanently connected to the same network as the infected machines offers little protection.
Ransom demands and double extortion
The classic model is simple: files are locked and the victim is told to pay for the decryption key. Acronis describes victims being prompted to pay within 24 to 48 hours, a deadline designed to rush decisions.
Double extortion adds a second lever. CISA says attackers pair encryption with data theft and pressure victims to pay by threatening to release the stolen data, a combination it calls “double extortion.” The consequence is that restoring from backup solves only half the problem: the stolen copy still exists, and the threat of release remains.
Should you pay the ransom?
Treat payment as a risky last resort, not a recovery plan. KnowBe4 states that once files are encrypted, the only way to get them back is to restore a backup or pay the ransom, which is exactly why backups decide how much leverage the attacker has. Paying carries real risks:
- No guaranteed key. Acronis cautions that in some campaigns, paying only enriches the attackers and the user never receives a private key.
- Paying twice. In extortion cases, attackers can make you pay once for the decryption key and again to delete the stolen data, according to KnowBe4.
- Deletion anyway. JPMorgan notes that criminals may delete your files even after payment, which is why it recommends multiple backups to restore critical systems.
If you have tested, offline backups, the decision is far easier because restoring is a real option. Without them, the choice is made under deadline pressure with poor odds.
Defenses matched to each stage
No single control stops ransomware, so match defenses to the stage you want to break.
- Entry. Work through prevention by initial access vector, as CISA’s guide does, with particular attention to compromised credentials and social engineering.
- Spread. Limit what any one account or device can reach, so a stolen credential does not become a route to higher-value systems.
- Recovery. CISA advises maintaining offline, encrypted backups of critical data and testing them regularly. JPMorgan adds that one set of backups should be offline and inaccessible from the organization’s main network.
- Response. CISA recommends creating, maintaining and regularly exercising a basic cyber incident response plan, so decisions about isolation, recovery and payment are not made for the first time during an attack.
Frequently asked questions
Can ransomware reach shared network folders?
Yes. KnowBe4 explains that it encrypts data files on the infected machine and on any network shares that machine can access, so mapped drives are at risk too.
Does an attack always involve both encryption and data theft?
No. JPMorgan describes the extortion stage as exfiltrating and/or encrypting files. Combining both is what CISA calls double extortion.
Is immutable backup storage always the right choice?
Not always. CISA advises using immutable storage with caution, because it does not meet compliance criteria for certain regulations and misconfiguring it can be costly. Check your regulatory obligations before relying on it.
Which baseline practices do CISA and NIST recommend?
CISA’s guide points to cross-sector cybersecurity performance goals developed by CISA and the National Institute of Standards and Technology (NIST) as minimum practices, and it groups its prevention advice by common initial access vectors.
