Ransomware falls into a few working types: encryption-only attacks that lock files, double extortion that also steals data, and data extortion that skips encryption. Each hurts in a different way, so each needs a different defense. Offline backups answer the first. They do not answer the others.
What is ransomware?
CISA describes ransomware as an ever-evolving form of malware designed to encrypt files on a device, making files and the systems that rely on them unusable. Attackers then demand ransom for decryption. CISA adds that actors often threaten to sell or leak exfiltrated data or authentication information if the ransom is not paid.
MITRE ATT&CK records the encryption step as technique T1486, Data Encrypted for Impact. It says adversaries may encrypt data on target systems, or on large numbers of systems in a network, to interrupt availability, and that they typically encrypt common user files such as Office documents, PDFs, images, videos, audio, text and source code, often renaming or tagging them. The page lists affected platforms including Windows, Linux, macOS, ESXi and infrastructure-as-a-service environments.
Type one: encryption only
The classic form. Attackers get in, spread, encrypt as much as they can and demand payment for a key. The damage is lost availability. If you have clean backups and a tested restore, you can recover without paying, although it takes time.
CISA's guidance warns that many variants look for backups to delete or encrypt, which is why backups should be offline and encrypted, and tested regularly.
Type two: double extortion
CISA's #StopRansomware guide describes how actors have shifted to more destructive and impactful approaches, also stealing victim data and pressuring victims to pay by threatening to release it. It calls the use of both tactics double extortion.
Backups do not help with this half. Restoring files does not un-steal them. The questions change: what data left, who must be notified, and what are the legal duties? Prepare these answers before an incident.
Type three: data extortion without encryption
CISA notes that in some cases actors exfiltrate data and threaten to release it as their sole form of extortion, without using ransomware at all. There is nothing to restore, and nothing visibly broken. A message arrives claiming they hold your data.
Here the defenses are about preventing and spotting theft: limiting access to sensitive stores, watching for unusual large transfers and keeping a clear record of what data lives where.
How do attackers get in?
CISA organizes its recommendations by initial access vector. Two it names are internet-facing vulnerabilities and misconfigurations, and phishing. Under the first, it advises not exposing services such as remote desktop on the web, running regular vulnerability scans, especially on internet-facing devices, and disabling unneeded protocols. Under the second, it advises user training, flagging external emails and filtering at the email gateway.
A constructed example: a small manufacturer has remote desktop open to the internet for a vendor. An attacker guesses a weak password, spreads to the file server and the backup server, which is on the same network and logged in. All three are encrypted. The company also finds that customer drawings were copied first. The case combines types one and two, and failed on three basics: exposed remote access, flat network and online backups.
How to check or apply this
- Find and close internet-exposed remote access. If it must stay, put it behind a VPN and multi-factor authentication.
- Patch internet-facing systems first, and scan them regularly.
- Keep offline, encrypted backups. Restore a sample each quarter and time it.
- Segment the network so a single compromised machine cannot reach backups and file servers.
- Map where sensitive data sits, and limit who can read it. Alert on large unusual transfers.
- Write a response plan that covers both restoration and a data theft scenario, including notification duties and who speaks to the press.
- Rehearse with leadership once a year.
Quick check
Do backups protect against double extortion?
Only partly. Backups let you restore systems, but they do not undo theft of data. You still face the threat of publication and notification duties.
Should you pay a ransom?
That is a business and legal decision. Check CISA's current guidance and involve counsel and law enforcement early. Payment does not guarantee data recovery or deletion.
Sources
Last reviewed: 18 October 2026.
