Malware and ransomware: how it gets in and how to stop it
Lesson 5 of 6
5Malware and ransomware: how it gets in and how to stop it
The big pictureOn an ordinary morning an employee opens a file called "October_invoice". Hours later every company file has a strange name, and every screen shows a message: "pay within 72 hours or we publish your data". This is not a film; it is the scenario incident responders deal with most around the world.
What the picture shows: A modern ransomware attack does not start with encryption, it ends with it. Before it come days or weeks of spreading and stealing data, which is the defender's chance to catch it.
Map of this part
The concepts in order, click any one to jump to it:
Two ways into the same idea
Malware is like burglars with different methods: a virus hides inside a file and does nothing until you open it. A worm moves from machine to machine on its own without anyone opening anything. A trojan dresses up as something useful (a free game, a fake "update"). Spyware quietly steals your passwords. And ransomware locks your files and demands money, and today it steals them first and threatens to publish them. Your protection is simple but needs discipline: update your devices, do not open an attachment you did not expect, turn on two-step sign-in, and keep a copy of your important files on a drive you unplug after the backup.
Classified by spread: a virus needs interaction, a worm exploits a network flaw to spread itself, and a trojan relies on deception. By payload: a RAT for remote control, an infostealer for sessions and saved passwords, a loader that fetches others, a rootkit that hides in the system, and a botnet for a herd of enslaved machines. CISA's #StopRansomware Guide lists the common ways in: flaws and misconfigurations in internet-facing systems (such as RDP), stolen credentials, phishing, precursor malware such as QakBot, and third parties. Prevention per the guide: offline, encrypted, tested backups, golden images, patching internet-facing systems and known exploited flaws (KEV) first, phishing-resistant MFA, and disabling macros in email attachments. Detection uses IOCs (file hashes, addresses, domains) and behaviours (mass encryption, deleting shadow copies) that an EDR watches for.
Before You Start
🎣Phishing and social engineering
Phishing is the door most malware walks through.
🎯How attackers think
The kill chain stages: delivery, then execution, then spread.
The Core Idea
1The whole family in one table
There are many names, but the two questions that matter to a defender are: how does it spread? and what does it do when it lands? The answer decides the defence.
| Kind | How it spreads | What it does | The key defence |
|---|---|---|---|
| Virus | Attaches to a file and needs you to open it | Alters or destroys files | Anti-malware and care |
| Worm | On its own through a network flaw | Spreads extremely fast | Patching and segmentation |
| Trojan | Disguised as useful software | Opens a back door for the attacker | Install from official sources only |
| Spyware and infostealer | An attachment or pirated software | Steals passwords and sessions | MFA and passkeys |
| Ransomware | After getting in by any route above | Steals, then encrypts and extorts | Offline backups |
| Botnet | Weakly protected devices, especially IoT | Denial of service and spam | Changing default passwords |
2Ransomware and double extortion
Old ransomware only encrypted files, so backups were enough. Attackers answered with double extortion: they steal the data before encrypting, then threaten to publish it even if you restore from backup. Some skip encryption entirely and just steal and extort. So today's defence is layered: stop the entry, catch movement inside the network early, and keep backups for recovery.
3Indicators of compromise: fingerprint and behaviour
How does a defender know a file is malicious? Two ways. Fingerprint (IOC): the file's SHA-256 hash, an IP address or a domain known to be bad, checked against threat intelligence lists. Fast, but it fails on any new variant. Behaviour: a program encrypting hundreds of files a minute, deleting shadow copies, or calling a strange server every 60 seconds. That is what an EDR watches for, and it catches even brand-new malware.
Version 2 changes one byte and slips past the hash list, but its behaviour gives it away. That is why you need both. The samples here are fictional.
import hashlib
# A tiny threat-intel list: SHA-256 hashes of files already known to be malicious.
known_bad = {
hashlib.sha256(b"fake-invoice-dropper v1").hexdigest(): "Loader (fictional sample)",
}
files = {
"October_invoice.pdf.exe": b"fake-invoice-dropper v1",
"October_invoice_v2.exe": b"fake-invoice-dropper v2",
"report.docx": b"quarterly numbers",
}
for name, content in files.items():
digest = hashlib.sha256(content).hexdigest()
verdict = known_bad.get(digest, "no match")
print(f"{name:<26} {digest[:16]}... {verdict}")
# Behaviour does not care about the hash: many renames in a short time is the signal.
renames_per_minute = {"backup-agent": 3, "October_invoice_v2.exe": 412}
for proc, rate in renames_per_minute.items():
print(f"{proc:<26} {rate:>4} renames/min", "<- ransomware-like" if rate > 100 else "")4The first minutes after infection
What you do in the first five minutes decides the size of the damage. Disconnect the machine from the network (cable and Wi-Fi) to stop the spread, and do not switch it off: memory holds evidence that vanishes on shutdown. Photograph the ransom note with your phone and report to IT or security at once, and do not try to "clean it up" alone. At home: unplug the machine, change the passwords of your important accounts from another clean device, and restore your files from the offline copy.
Worked example
The task: a small law firm: 15 machines, a nightly backup to an always-connected network drive, and RDP open to the internet so lawyers can work from home with passwords only. Rank the three most important fixes.
The answer: (1) close the exposed RDP and replace it with a VPN with MFA, since it is one of the best-known ransomware doors in CISA's guide. (2) make one copy offline (a drive that gets unplugged, or immutable cloud storage) and test a restore monthly, because the connected drive will be encrypted with everything else. (3) turn on automatic updates and MFA for email, and disable macros in email attachments. Note the order: close the widest door first, then guarantee recovery, then narrow the remaining doors.
Myth vs Reality
| Myth | Reality |
|---|---|
| I have antivirus, so I am protected. | It mostly catches the known. New strains and fileless attacks need updates, MFA, backups and care. |
| Macs and phones do not get malware. | Less often, but they do, and infostealers on Mac are on the rise. |
| Pay the ransom and the problem is over. | There is no guarantee of getting the data back or of it staying unpublished, and you may be hit again. CISA advises against paying. |
Where you meet it at work
🏠At home
Automatic updates, a copy on a drive you unplug, and installs from official stores only.
🚨SOC analyst
Triages EDR alerts and looks up the file hash in threat intelligence.
🏥Hospitals and councils
Among the hardest hit by ransomware; continuity plans there are a matter of life.
Test your understanding
Software that moves from machine to machine through a flaw without anyone opening anything is a:
Spreading on its own is what sets a worm apart.
What is "double extortion"?
That is why a backup alone is no longer enough.
Your machine shows a ransom note right now. What is the first step?
Disconnecting stops the spread, and leaving it on keeps the evidence in memory.
Why does hash detection fail on a new variant of the malware?
The avalanche effect in hash functions, which is why we add behaviour detection.
Which backup most likely survives ransomware?
The malware reaches everything that is connected.
Which of these is NOT an indicator of compromise (IOC)?
An indicator is a technical trace that links you to a known attack.
Quick review cards
Check Your Understanding
Why are backups alone not enough against modern ransomware?
They bring the files back but do not stop publication of data stolen before encryption. You also need to block entry and catch early movement.
A friend says a pirated copy of a design app "works perfectly". What is the risk?
Pirated software is one of the most common ways trojans and infostealers spread; the app may really work while it steals passwords in the background.
What is the difference between hash and behaviour detection?
Hashes compare the file with a known list: fast but blind to new ones. Behaviour watches what the program does: slower with more false alarms, but it catches the new.
Resources for this lesson
Grouped by type. Start with the official docs for precision, or an article or video for the explanation.
Done with this lesson?
Sign in to save your progress.