Ransomware is malware that encrypts files so systems become unusable, after which the attacker demands payment for decryption. The jargon around it describes what happens before and after the encryption: stealing data, threatening to leak it, moving across the network and deleting backups. Each term points to a specific defense.
Ransomware
CISA defines it as an ever-evolving form of malware designed to encrypt files on a device, rendering any files and the systems that rely on them unusable. Malicious actors then demand ransom in exchange for decryption. It hits individuals, governments, healthcare and service providers, and CISA notes that an attack on a provider can reach that provider's customers too.
Defense link: you cannot decide whether files get encrypted once code is running, so your plan has to assume it can happen and make recovery cheap.
Data exfiltration and extortion
Exfiltration means copying data out of your environment. CISA's FAQ says ransomware actors often target and threaten to sell or leak exfiltrated data or authentication information if the ransom is not paid. Security writers often call the pairing of encryption with a leak threat double extortion. The phrase is shorthand for two pressures at once: you cannot work, and your data may be published.
The CISA FAQ also describes secondary extortion: publicly naming and shaming victims as a way to pressure them.
Defense link: backups solve the first pressure and do nothing for the second. Limiting what an account can read, and watching for large outbound transfers, addresses the second.
Lateral movement
CISA says malicious actors engage in lateral movement to target critical data and propagate ransomware across entire networks. It means using one compromised machine or account to reach others. In MITRE ATT&CK, Lateral Movement is a named tactic, the adversary's goal of moving through the environment.
Defense link: segmentation, host firewalls that block workstation to workstation traffic, and separate admin accounts all make each hop harder.
Backup deletion
CISA notes actors increasingly use tactics such as deleting system backups to make restoration and recovery more difficult or infeasible. A backup that the same domain admin account can delete is a backup that an attacker with that account can delete.
Defense link: keep copies offline or in a store that production credentials cannot modify, and test a restore. CISA's own advice is to back up data regularly, keep it on a separate device and store it offline.
Tactics, techniques and procedures
You will see TTPs everywhere in ransomware reporting. MITRE's FAQ defines tactics as the why (the adversary's goal), techniques as the how, and procedures as the specific implementation seen in the wild. Reading a report with those three words in mind helps: the tactic is credential access, the technique is credential dumping, the procedure is the exact tool and command one group used.
Ransom demand, and what CISA says about paying
CISA says some victims pay to recover their files, but there is no guarantee they will recover them if they do. It also reports that the monetary value of demands has risen, with some exceeding 1 million US dollars. Whether to pay is a legal, financial and law enforcement question. The joint #StopRansomware Guide from CISA, the FBI, NSA and MS-ISAC includes a response checklist, so read it before an incident, not during.
How to check or apply this
- Map your crown jewels. Write down where the data you cannot lose lives and who can reach it.
- Test a full restore of one critical system this quarter and record how long it took.
- Keep at least one backup copy that production admin credentials cannot delete.
- Apply least privilege and application allow listing, as CISA recommends, so malware has less to run and spread with.
- Watch for the early signs: new admin accounts, mass file access, large outbound transfers, disabled security tools.
- Keep the incident response plan, contact list and the CISA checklist on paper or somewhere that survives a network outage.
- Patch internet-facing systems first, since outdated software is where most attacks start, per CISA's guidance.
Quick check
What is double extortion?
It is a common name for combining file encryption with a threat to leak stolen data. CISA describes the underlying behavior: actors threaten to sell or leak exfiltrated data if the ransom is not paid.
Do backups fully protect against ransomware?
They protect against the loss of availability if they survive and restore correctly. They do not stop data theft or leak threats.
Sources
Last reviewed: 18 October 2026.
