What types of ransomware attacks exist and how do you defend?

Ransomware attacks fall into three patterns: encryption of systems, theft of data used for extortion, and both together, called double extortion. Protection follows the pattern. Offline backups answer encryption, access control and monitoring answer theft, and patching, MFA and segmentation reduce both.

What are the main types?

CISA's ransomware guide describes the basics. Ransomware encrypts files and the systems that depend on them, and attackers demand payment for decryption. In double extortion, attackers also steal data and threaten to publish it. The guide adds that some actors skip encryption and use only data theft for extortion.

That gives a useful sorting rule. Ask two questions after an incident: were systems locked, and did data leave? The answers decide whether backups solve your problem. If only encryption happened, clean backups may restore you. If data left, a restore does not undo the exposure, and notification duties may apply.

How does ransomware get in?

CISA lists common entry points: internet-facing vulnerabilities and misconfigurations such as exposed RDP, unpatched systems and weak SMB settings; compromised credentials; phishing, including macro-enabled files; precursor malware such as QakBot, Emotet and Bumblebee; social engineering; and compromised third parties and managed service providers.

Constructed example: an organization leaves a remote desktop service reachable from the internet for one contractor. Credentials for it appear in a stolen password list. The attacker logs in, finds a flat network and reaches the file server. No exotic technique was involved, only an exposed service and a reused password.

Which protections match which pattern?

Against encryption. Keep offline, encrypted backups and test restores regularly. Keep golden images and infrastructure-as-code templates so servers can be rebuilt. CISA states these directly.

Against theft. Use least privilege and segmentation so one compromised account cannot reach all data. Centralize logs, retain them for as long as you can, and baseline normal activity so unusual outbound transfer stands out.

Against both. Patch internet-facing systems quickly, especially known exploited vulnerabilities. Use phishing-resistant MFA, unique passwords of 15 or more characters, and separate admin accounts. Limit RDP, disable unused services and harden SMB. Filter email, enable DMARC and block risky attachments.

What should the response plan contain?

CISA's checklist runs in four stages: detect and analyze, report and notify, contain and eradicate, then recover. Some points people miss: isolate systems at the switch level when possible, use out-of-band communication so the attacker does not see you plan, power down only as a last resort, capture images and memory before cleanup, and find the initial breach point before rebuilding. Restore from clean offline backups in priority order.

How to check or apply this

1. List internet-facing services and close any remote desktop exposure.
2. Enforce phishing-resistant MFA on remote access, email and admin accounts.
3. Confirm one backup copy is offline, then perform a full restore test and time it.
4. Segment so workstations cannot reach backup systems or domain controllers.
5. Write the response plan, including who calls insurers, counsel and law enforcement, and rehearse it once.
6. Patch known exploited vulnerabilities on a short clock, and track third party access.

Where does Safeguard fit?

For the patching item, Safeguard scans dependencies and code and uses reachability analysis to show which vulnerabilities your applications actually call, so urgent ones surface first. It is not endpoint or network protection, and it does not stop ransomware on its own.

Quick check

Sources

• CISA, #StopRansomware Guide

Last reviewed: 18 October 2026.