What Is Ransomware?

Definition

Ransomware is malicious software that locks your files or systems, usually by encrypting them, and then demands payment for the key. CISA notes that most groups now also steal data first and threaten to publish it, a tactic called "double extortion," and some skip the encryption and extort with stolen data alone.

How It Works

Most ransomware attacks are a sequence of steps, not a single click:

1. Get in. Common entry points are a VPN or remote access portal without MFA, stolen or guessed passwords, phishing, or an unpatched internet-facing device.
2. Spread and escalate. The attacker moves from the first machine to servers and admin accounts, often with legitimate remote management tools so the activity blends in.
3. Break your recovery. CISA's #StopRansomware Guide warns that attackers look for and delete or encrypt reachable backups, and misuse built-in Windows tools such as vssadmin.exe and wbadmin.exe to remove shadow copies.
4. Steal data. Files are copied out before anything is encrypted, so a restore from backup does not end the extortion.
5. Encrypt and demand. Files are renamed with a new extension and a ransom note appears, or the attacker waits to be contacted.

Real-World Example

Akira was the ransomware variant reported most often to the FBI's IC3 in 2025. The joint advisory AA24-109A (originally April 18, 2024, updated November 13, 2025) says Akira actors "primarily target small- and medium-sized businesses," often get in through VPN services without MFA, and likely abused a SonicWall vulnerability, CVE-2024-40766. They have targeted VMware ESXi and, in a June 2025 incident, Nutanix AHV virtual machines. Encrypted files carry the extension .akira or .powerranges. The advisory says Akira does not leave payment instructions until the victim makes contact, threatens to publish stolen data, and has sometimes phoned victim companies. As of late September 2025, Akira had claimed about $244.17 million in ransom proceeds.

Why It Matters for a Small Business

Verizon's 2026 DBIR found ransomware in 48% of all breaches, and about 96% of ransomware victims with a known organization size were small and medium-sized businesses. Payments are falling: 69% of ransomware victims in the dataset did not pay, and the median payment was $139,875.

The FBI's IC3 received 3,611 ransomware complaints in 2025 with $32,320,105 in reported losses. IC3 cautions that this figure normally leaves out lost business, time, wages, files, equipment, and paid remediation, so it understates the real cost. More than 1,400 of those complaints came from organizations outside the critical infrastructure sectors, led by legal services (18%), contracting services such as electricians and general contractors (17%), and engineering and architectural firms (10%). These are ordinary small businesses.

How to Spot It / How DTS Handles It

Early signs: antivirus or EDR suddenly disabled, new admin accounts, remote access tools nobody installed, backups or shadow copies deleted, large outbound data transfers, and VPN logins at odd hours. Late signs: renamed files and a ransom note.

CISA's first steps: identify impacted systems and isolate them immediately; take the network offline at the switch if many systems are affected; power a device down only if you cannot disconnect it, because that destroys evidence in memory; and coordinate by phone so the attacker cannot watch you respond. Report it to CISA, the FBI, or IC3.

DTS runs ransomware response for small businesses: isolation, evidence capture, scoping, rebuild from clean backups, and help with insurer and law enforcement contact.

Related Terms

• Phishing: one of the most common ways ransomware crews get in.
• Containment: isolating systems before the encryption spreads.
• Recovery: restoring from backups the attacker could not reach.
• Backups and the 3-2-1 rule: the difference between paying and not paying.
• Multi-factor authentication (MFA): the missing control in many VPN break-ins.
• Indicators of compromise: file extensions and ransom note names that confirm the variant.
• Incident response: the overall process a ransomware attack tests.

Sources

• CISA and MS-ISAC, #StopRansomware Guide (Part 1 prevention; Part 2 response checklist): https://www.cisa.gov/stopransomware/ransomware-guide
• FBI, CISA, and partners, Cybersecurity Advisory AA24-109A, #StopRansomware: Akira Ransomware (last revised November 13, 2025): https://www.cisa.gov/news-events/cybersecurity-advisories/aa24-109a
• FBI Internet Crime Complaint Center, 2025 IC3 Annual Report (ransomware section and top variants): https://www.ic3.gov/AnnualReport/Reports/2025_IC3Report.pdf
• Verizon, 2026 Data Breach Investigations Report (key findings; SMB focused analysis): https://www.verizon.com/business/resources/Tf3/reports/2026-dbir-data-breach-investigations-report.pdf

---

Last updated October 14, 2026.