Ransomware attack is the operation in which a criminal group gains access to an organization's network, copies the data out, encrypts the systems, and demands a ransom to return the access and withhold what it took. Because the copy leaves before the encryption starts, restoring from backup no longer closes the incident. It almost always begins with a leaked valid credential or an internet-facing service running a known flaw.
Nearly every incident report that reaches us hides the same sentence somewhere in the middle. The asset they came in through was already known. It was in the inventory, or it should have been. The patch existed. Nobody had applied it, because it sat at position 400 in a 3,000-item queue sorted by theoretical severity.
That is the uncomfortable part. Modern ransomware rarely depends on a novel technique. It depends on the window between a flaw being published and being fixed, and on a work queue that cannot tell the flaw being exploited today from the one that will probably never be touched.
The Verizon Data Breach Investigations Report 2025 found ransomware in 44% of the breaches it analyzed. In the same report, vulnerability exploitation accounts for about 20% of initial access and grew 34% in a year, driven by flaws in edge devices and VPNs. Of those compromised appliances, only 54% were ever patched, with a median of 32 days between disclosure and remediation. Thirty-two days is an eternity when a public exploit is circulating.
What is ransomware
Ransomware is malicious software that holds an organization's data hostage, encrypts the files, and demands payment to give the access back. That is the textbook definition, and it stopped being complete a long time ago.
The model that dominates today is double extortion. Before encrypting anything, the group copies the data out. Backup stops being the safety net it used to be. You restore the systems over a weekend and you are still being blackmailed with the publication of what they took. In some cases the pressure goes further, with direct contact to the victim's customers, partners, and regulators, or a denial-of-service attack while the negotiation runs.
The practical consequence is that protecting a company against ransomware has become the work of closing off access. Recovery still matters, and it still arrives late: once the data is out, no restore fixes it.
Types of ransomware
Sorting by malware family ages badly, because the groups swap code constantly. Sorting by extortion model is what changes your response plan.
Crypto ransomware. Encrypts files and leaves the machine running. This is the most common form in corporate environments, and the one that takes down an entire production system overnight.
Locker ransomware. Locks the screen or the device without encrypting file by file. It shows up on desktops and phones more often than on servers.
Double extortion. Exfiltration before encryption, with a deadline for publication on a leak site. It has become the standard for the larger groups.
Encryption-free extortion. The group steals the data and does not bother encrypting. Cl0p's campaigns against managed file transfer tools worked this way, producing hundreds of victims from a single flaw in one edge product.
Ransomware as a service (RaaS). The operator builds the code and the negotiation infrastructure, and affiliates run the attacks for a cut of the ransom. That is why the same family turns up in victims with nothing in common.
Wiper in disguise. Presents itself as ransomware and destroys the data with no recovery key at all. NotPetya, in 2017, was the most expensive case in this category.
How a ransomware attack works, stage by stage
There is a folk version of ransomware where an employee opens an attachment and the screen turns red a second later. The real thing has more stages and usually takes days.
- Initial access. In most cases it comes from one of three places: a valid credential bought or leaked, an internet-facing service with a known flaw, or a well-built phishing email. The 2025 DBIR puts stolen credentials at 22% of cases and phishing at 16%.
- Persistence. Once inside, the operator encrypts nothing. They make sure they can come back, creating accounts, scheduling tasks, and installing legitimate remote access tools that the antivirus ignores.
- Escalation and lateral movement. They hunt for administrative privilege and start walking the network, mapping domain controllers, file servers, and the backup console.
- Backup sabotage. An experienced operator deletes or corrupts the copies before anything else, because an intact backup collapses the price of the ransom.
- Exfiltration. This can run for days and leave through ordinary cloud services so the outbound traffic draws no attention.
- Encryption. The last step, usually fired off in the small hours of a Friday night, when the response team is thin.
By the time the screen shows up, the adversary has been in the environment for a long while and already took what they wanted. Every stage in that chain was a detection opportunity the organization had and did not use. But the cheapest stage to block is still the first one.
Why a severity-ordered patch queue does not protect you
Every security team lives with the same arithmetic problem. The scanner returns thousands of vulnerabilities. The team can fix a few dozen per sprint. Somebody has to choose.
The choice is almost always made by CVSS, which sounds reasonable and is not. CVSS measures the potential damage of a flaw under ideal conditions for the attacker. It says nothing about the probability that anyone will try. There are 9.8 CVEs published three years ago with no known exploit, and there are medium-scored flaws being used in active ransomware campaigns right now.
The result is a queue that burns the team's capacity on items that are serious on paper while the one the adversary will use next week goes untouched. That is why the share of patched edge devices in the DBIR is so low. The team is not sloppy. The queue it was handed is in the wrong order.
Three signals improve that ordering a lot, and none of them is CVSS:
- The vulnerability is in the CISA KEV catalog, which means confirmed exploitation in the wild.
- A public, working exploit exists, which drops the cost of using it to near zero.
- EPSS puts a high probability on exploitation in the next 30 days.
Anyone who crosses all three is already operating well above average. One thing is still missing, and it is the one that matters most. Knowing what is under attack right now, not what was attacked at some point in the past.
Emerging threat: watching exploitation as it happens
CSURFACE runs a sensor mesh that presents itself on the internet as vulnerable infrastructure and records what gets tried against it. When a group starts scanning the internet for a specific flaw, that scan hits the sensors before it becomes an incident at a customer. That is how we know which CVEs are under active attack, at what intensity, and since when.
That data is open at threatsensor.csurface.io, free to use. Anyone can look up what is being exploited at the moment, with no contract and no commercial sign-up. We think raw emerging-threat information should circulate, including to people who are not our customers.
What the open data does not do is answer the only question your team cares about: does this hit me?
That is where qualification comes in, and that is the platform's job. Knowing a CVE is under attack has limited value if you do not know whether that product exists in your environment, in which version, exposed to whom, in which business unit, and supporting which process. Continuous discovery surfaces what your organization actually exposes on the internet, including what nobody registered. Prioritization crosses that inventory with the observed exploitation signal and hands back a short queue, specific to your surface, where the first item is the one a ransomware group could use against you this week.
The difference between the two shows up in the numbers. Of the thousands of vulnerabilities disclosed in a year, a few hundred carry KEV, a public exploit, and a high EPSS at the same time. Inside that core, a smaller fraction is under observed attack. And of that fraction, what exists in your environment usually fits on one page. Going from thousands of items to one page is what makes remediation possible within the team's real capacity. The method is described in detail in Exploit & Threat Intelligence.
Ransomware prevention checklist: ten measures
None of these is new. The order is what matters, because it mirrors how attacks actually get in.
- Keep the inventory of what you expose current on its own. None of the nine measures below reaches an asset nobody knows exists, and a spreadsheet reviewed once a quarter does not track an environment that changes every week. Attack surface management finds every new domain, subdomain, IP, port, and service at scale, attributes each one to the business unit that owns it, and flags what shows up, with no agents and without depending on someone remembering to register it.
- Patch what is internet-facing and under active exploitation first. Remote access services, VPNs, firewalls, edge appliances, and authentication portals, in that order, before any internal high-severity item.
- Require phishing-resistant MFA on every remote access path, VPN, and admin panel. A valid credential is the most common initial vector, and a password on its own holds nothing up anymore.
- Monitor corporate credential leaks. A good share of initial access is bought ready-made from brokers. Catching the exposed credential before it gets used cuts the chain at the start, which is what credential monitoring is for.
- Protect the backup as if it were the primary target, because it is. Immutable copies, outside the domain, with separate credentials, and a restore test with a measured completion time. A backup that has never been restored is still a hypothesis.
- Segment the network so a compromised endpoint cannot reach the domain controller or the backup console. Lateral movement is the stage where a small incident becomes a disaster.
- Keep EDR on every endpoint and server, with alerts someone actually watches, and restrict what is allowed to run on servers. A tool installed without a response rotation only produces a record of what happened, and the legitimate remote access tools ransomware operators use get past antivirus precisely because they are legitimate.
- Treat your suppliers as part of your surface. The 2025 DBIR shows third-party involvement doubling from 15% to 30% of breaches. The partner's access is your problem, and that is what supply chain risk management addresses.
- Keep a written, tested response plan, with the payment decision made before the incident, legal contacts named, notification obligations mapped, and communications drafted. Nobody makes good decisions at three in the morning.
- Validate the controls instead of trusting the configuration. Continuous validation confirms whether the exposure is genuinely exploitable and whether the control that should block the path actually blocks it.
The first item is a prerequisite for the other nine: without an inventory you fix what you know about, and the adversary comes in through what you do not. With that in place, if your company can only execute three more this quarter, do the second, the third, and the fifth. That combination closes the most-used doors and preserves your ability to recover.
Where CTEM fits
Gartner organized this work into five phases under the name Continuous Threat Exposure Management: scoping, discovery, prioritization, validation, and mobilization. The cycle matters here because it attacks exactly the two failures described above.
Discovery fixes the incomplete inventory, which is why a forgotten asset becomes the way in. Prioritization fixes the wrong queue, as long as it is fed by real exploitation rather than theoretical severity. Validation confirms that the exposure is exploitable. Mobilization turns all of it into a ticket with an owner and a deadline, and that is where most programs stall.
How this gets built in practice is described in CTEM, and external surface coverage in attack surface management.
What a ransomware attack costs
According to Sophos's State of Ransomware 2025, which surveyed 3,400 IT and security leaders across 17 countries, the average recovery cost landed at $1.53 million, not counting the ransom. Close to half of the affected organizations paid. Half of those who paid did not get everything back.
Those are global figures and work as an order of magnitude, not as an estimate for your case. The number your board cares about is yours. What the outage of your critical processes would cost, for as long as your operation would take to come back. That calculation is what cyber risk quantification does, translating technical exposure into currency. You can start with the risk calculator, which runs without sign-up.
The cases that made the news follow the same pattern everywhere. Colonial Pipeline shut down fuel distribution across the US East Coast in 2021 after an attack that started with a single VPN credential and no MFA. Change Healthcare, in 2024, disrupted claims processing for months. In neither case did the public discussion revolve around a sophisticated intrusion technique.
Frequently asked questions
What is the main goal of a ransomware attack?
Extorting money. Encryption and data theft are the pressure tools, and the ransom is the point. That is why the operator goes after backups before encrypting, and why the data is copied out first: each layer of pressure raises the figure they can ask for and shrinks your room to refuse.
What is the difference between a virus and ransomware?
A virus is a program that replicates by inserting code into other files, and replication is what defines it. Ransomware is defined by its goal, extorting money by holding data hostage. Ransomware can spread on its own, as WannaCry did in 2017, but most of it today is installed by hand once the operator is already inside the network.
What is the difference between phishing and ransomware?
Phishing is an access technique and ransomware is the outcome of the attack. Phishing steals the credential or drops the first program on the victim's machine, and the ransomware arrives days later, after the operator has mapped the network. Per the 2025 DBIR, phishing appears in 16% of initial access cases, behind stolen credentials.
Does paying the ransom solve the problem?
Half the time it does not solve it completely. The Sophos research shows a meaningful share of those who paid did not recover all of their data. Payment also does nothing to stop the publication of what was exfiltrated, since the only guarantee is a criminal's word.
Isn't a backup enough?
A backup answers the encryption and does nothing about extortion by leak. It is still mandatory, as long as it is immutable, outside the domain, and genuinely tested, because the backup console is among the operator's first targets.
What is the most common ransomware entry point?
A valid credential and an exposed service with a known flaw, in that order. Per the 2025 DBIR, stolen credentials show up in 22% of cases and vulnerability exploitation in about 20%, with sharp growth on edge devices.
How long does an attacker stay in the network before encrypting?
Hours to weeks. Opportunistic campaigns against an edge flaw can encrypt in under a day. Operations that prioritize exfiltration usually take days, and detection is still possible during that window.
How do you remove ransomware from an environment?
Removing the binary is the easy part and the least useful one. What has to go is the operator's access: the accounts they created, the scheduled tasks, the remote access tools they installed, and the compromised domain credentials. Rebuilding the encrypted machine without closing the way in hands the environment back to the same group within weeks.
How do I know whether a vulnerability in my environment is under attack?
Check threatsensor.csurface.io for open data on active exploitation. To cross that signal with what your organization exposes and get the queue already sorted, that is what the platform does in prioritization.
How do I protect the company with a small security team?
Concentrate the capacity you have on what is internet-facing and under confirmed exploitation, and automate the rest of the inventory. A team of three fixing the right ten exposures a month ends up better protected than a team of ten fixing a hundred items picked by severity.
Does cyber insurance replace a security program?
No. The policy transfers part of the financial loss and does nothing to reduce the probability of the incident. Insurers have been demanding evidence of controls both to underwrite and to pay out, which is covered in cyber insurance.
Where to start
If you are reading this with a patch queue that does not fit your team's capacity, the next step is to reorder the queue, not to grow it. Check the open emerging-threat data at threatsensor.csurface.io and see how many of the CVEs under attack today exist on your perimeter.
If you want that comparison run against your real surface, with asset attribution and a queue ready to become tickets, talk to us.