Tools / Cyber Security Interview Questions
What is Ransomware?
Ransomware is malware that encrypts a victim's files or locks them out of their system, then demands a ransom, usually in cryptocurrency, in exchange for restoring access.
Once it gains a foothold, ransomware often spreads laterally across shared drives and connected systems before triggering encryption, so one infected laptop can end up locking an entire file server.
- Delivered via phishing emails, malicious downloads, or exposed remote desktop services
- Modern variants also steal data first and threaten to leak it, known as double extortion
- Recovery relies on offline backups since paying the ransom doesn't guarantee decryption
Regular offline backups, patching, and restricting administrative privileges are the most effective defenses.
What does ransomware typically demand?
What is 'double extortion' in a ransomware attack?
More Related questions...
