Ransomware

Ransomware is malware that encrypts or locks data or entire systems in order to extort a ransom for their release. Modern ransomware attacks often combine encryption with prior data theft and threaten to publish it. Ransomware is one of the threats with the most serious economic consequences for businesses, hospitals, local authorities and operators of critical infrastructure.

What is ransomware?

Ransomware refers to malware whose business model is based on extortion. The name is derived from the English word ‘ransom’. Unlike spyware, which aims to remain undetected for as long as possible, ransomware deliberately reveals itself once it has completed its task: it leaves behind a ransom demand, often accompanied by a deadline and a contact address on the dark web.

However, this visibility is misleading when viewed over time. The moment the encryption begins is not the start of the attack, but its conclusion. Between the initial access to the network and the encryption, there are often days or even weeks during which attackers spread throughout the network, expand their privileges, extract data and deliberately destroy the ability to recover. Anyone who regards ransomware as merely an encryption problem therefore fails to recognise the actual structure of the attack.

Another aspect has changed fundamentally. Early ransomware was widely distributed and targeted random victims. Today, targeted attacks on organisations dominate, in which the ransom demand is tailored to the victim’s presumed ability to pay, and attackers assess which systems are business-critical before carrying out the encryption. Hospitals, local authorities, municipal utilities and medium-sized industrial firms are particularly targeted because they face high pressure to recover quickly and often have limited security resources.

How does ransomware get into a network?

Ransomware almost never enters the network directly, but rather via an initial point of entry, which is often procured and resold by specialised actors. The main points of entry are:

• Phishing and social engineering: malicious attachments, links to fake login pages, phone calls requesting remote support
• Compromised credentials: from previous data breaches, via credential stuffing or through infostealer malware on personal devices
• Unpatched systems accessible from the internet: VPN gateways, firewalls, remote maintenance access points, email and file servers
• Unsecured remote access: remote desktop access without multi-factor authentication or access restrictions
• Supply chain and service providers: compromised managed service providers, software updates or remote maintenance connections
• Misconfigurations in cloud environments: exposed storage, over-privileged service accounts, lack of logging

It is striking that none of these methods is particularly sophisticated. The vast majority of successful attacks exploit known vulnerabilities for which updates are available, or valid login credentials that were simply not protected by a second factor. This is precisely where the good news lies: the most effective countermeasures are not exotic, but consist of consistent basic security practices.

How does a ransomware attack work?

A ransomware attack usually follows a set sequence that spans several days, with the encryption taking place only at the very end.

1. Initial access. Attackers gain access via one of the aforementioned entry points, often purchased from a specialist access broker.
2. Persistence and reconnaissance. They establish persistent access, create accounts and gain an overview of the network structure, backup systems, security software and business-critical applications.
3. Privilege escalation. The target is privileged accounts, in particular administrator rights within the directory service. Whoever controls the domain effectively controls every connected system.
4. Lateral movement. From a starting point, attackers compromise additional systems, usually using legitimate built-in operating system tools, which makes detection harder.
5. Data exfiltration. Large volumes of data are exfiltrated before encryption – the basis for the subsequent threat of publication.
6. Destruction of recovery capabilities. Shadow copies are deleted, backup systems are encrypted or their retention periods manipulated, and recovery points are removed.
7. Encryption and extortion. The actual encryption is rolled out centrally, usually outside business hours, followed by the ransom demand.

This sequence explains why attacks so often come to light at weekends or on public holidays: attackers choose the time when staff are least likely to be on site. It also explains why destroying backups is not a side effect, but a planned step.

What types of ransomware and extortion schemes are there?

Ransomware differs in terms of its technical impact and the extortion model that attackers base it on.

Variant	Effect	Implications for those affected
Crypto-ransomware	Encrypts files, databases and, in some cases, entire storage media	Most common form; recovery is only possible via backups or keys
Locker-Ransomware	Restricts access to the system without encrypting data	Damage is usually minor; data remains intact
Leakware	Refrains from using encryption, threatens publication alone	Safeguards are of no help; the problem lies in the disclosure
Wiper	Irreversibly destroys data, masquerades as ransomware	Payment is pointless, as there is no working key
Simple blackmail	Encryption with a ransom demand	Restoring from backups largely resolves the situation
Double blackmail	Encryption plus previous data theft	Even after a successful recovery, the pressure to publish remains
Triple blackmail	Additional pressure caused by harassment campaigns or direct approaches to those affected	Customers, patients, regulators and the press are actively involved

The shift towards double extortion has fundamentally altered the threat landscape. As long as ransomware merely encrypted data, a robust backup strategy was the complete solution. With the upstream data theft, however, a data protection incident also arises which persists regardless of technical recovery – entailing reporting and notification obligations, potential claims for damages and permanent publication on leak sites on the dark web.

What is ransomware-as-a-service?

Ransomware-as-a-Service (RaaS) refers to the division of labour within the ransomware criminal ecosystem, modelled on legitimate software business models. One group develops and maintains the malware, manages payment processing, the data leak site and the negotiation infrastructure. Other actors – known as ‘partners’ – carry out the actual attacks and share the proceeds with the operators.

This ecosystem is complemented by further specialisations: access brokers procure and sell initial access, service providers handle negotiations, whilst others manage the data exfiltration. For defenders, this has two practical implications. Firstly, the technical barrier to entry is significantly lowered, meaning that the number of actors is growing regardless of their capabilities. Secondly, the modus operandi varies greatly even within the same ransomware family, as different partners operate differently – detection rules that rely on a fixed attack pattern are therefore only of limited use.

What damage does ransomware cause?

The immediate damage caused by a ransomware attack is the disruption: encrypted systems, production at a standstill, and specialist processes that cannot be accessed. However, the actual costs arise from the knock-on effects and extend over a significantly longer period than the technical recovery takes.

In the case of major incidents, business interruptions can last for weeks, or in some cases months, because systems must be rebuilt from scratch rather than simply restored. At the same time, the data breach gives rise to a data protection incident involving reporting and notification obligations, as well as considerable effort to reconstruct the affected data sets. Added to this are costs for external forensic analysis, legal advice, crisis communication and temporary workarounds, which often exceed the pure IT costs.

German examples illustrate the extent of the impact. An attack on a university hospital in 2020 led to the suspension of emergency care services. In 2021, a district in Saxony-Anhalt became the first local authority in Germany to declare a state of emergency following a cyberattack, as social security payments, vehicle registration and other mandatory services were restricted for months. In 2023, an attack on a local authority IT service provider simultaneously paralysed the administrations of several dozen local authorities – a concentration risk that is inherent in outsourced IT.

What is remarkable about these cases is not so much the technical aspect as the duration. Rebuilding entire directory services, specialist systems and interfaces is not an IT project that can be completed in a matter of days, and the organisation must remain operational during this time.

How do organisations protect themselves against ransomware?

Effective ransomware protection addresses three points in the attack chain: preventing initial access, limiting the spread, and ensuring recovery. No single measure is sufficient, but a few measures implemented consistently can have a disproportionately large impact.

Prevent first-time access

This includes multi-factor authentication for all externally accessible points of entry – preferably in a form that is resistant to phishing – robust patch management with short deadlines for systems exposed to the internet, the reduction of the attack surface by disabling unnecessary remote access points, email security with attachment scanning and link analysis, and the deactivation of macros from the internet.

Limiting the spread

Effective measures include network segmentation between management, production and administrative networks; an authorisation scheme based on the principle of least privilege; separate administrative accounts without access to email or the internet; a tiered administration model for the directory service; and endpoint detection that reports suspicious behaviour rather than merely checking for known signatures. These principles are summarised by the zero-trust approach.

Back up your recovery

The backup strategy is based on the 3-2-1 rule: three copies of the data on two different media, one of which is stored in a separate location. This is crucially supplemented by immutable or physically separate backups, which cannot be deleted or altered even with administrator rights, as well as by regularly practised restores. An ISO 27001 management system and an effective business continuity management system provide the methodological framework for this.

Why aren’t backups alone enough to protect against ransomware?

Backups are essential for protecting against ransomware, but they are not a complete solution for three reasons. Firstly, they are themselves a target: attackers specifically seek out backup systems because destroying them creates pressure to pay. Backups that can be accessed via the same administrative accounts as the production environment are as vulnerable as the production environment itself.

Secondly, backups do not solve the problem of data leakage. In cases of double extortion, the threat of publication remains even if all systems have been successfully restored – the data breach persists and must be reported.

Thirdly, many organisations underestimate the time required for a full recovery. A functioning backup says nothing about the recovery time if hundreds of servers, directory services, databases and interfaces have to be rebuilt in the correct order and without the malware returning. Only practised restores, including the recovery sequence, provide reliable information on this – not the green tick in the backup log.

What should you do following a ransomware attack?

Following a ransomware attack, the order in which actions are taken determines the extent of the damage: stop the spread, secure evidence, and only then restore systems. The first steps involve isolating affected systems and network segments, disconnecting the backup infrastructure from the production network, convening the crisis management team and engaging specialist forensic experts. Do not shut down or clean up affected systems prematurely, as this can destroy evidence and clues about the attack vector.

When it comes to recovery, the guiding principle is that compromised environments must be rebuilt from scratch rather than cleaned up. Until it is clear how the attackers gained access and what access points they left behind, restoring the system to the same environment will almost invariably lead to a second incident. This involves completely replacing privileged access credentials, reviewing created accounts and tasks, and cleaning up the directory service. At the same time, reporting channels are activated – and customers, partners and, depending on the extent of the impact, the public are contacted.

It is precisely here that a dependency becomes apparent which is often missing from contingency plans. In the event of a ransomware attack, the entire domain is considered compromised: the directory service, email, telephony via the IT infrastructure, file storage systems and collaboration platforms are either unavailable or can no longer be regarded as trustworthy. This also renders the contact lists, escalation plans and emergency documents stored there unusable. Organisations therefore maintain pre-approved communication channels that function independently of the affected infrastructure, document decisions in a traceable manner and are regularly tested as part of crisis communication exercises. If such a channel is lacking, those involved resort to private devices and consumer messaging apps – with consequences for confidentiality, GDPR compliance and subsequent investigation.

Teamwire demonstrates, in a demo or a free trial, how to set up a channel independent of the regular IT system for crisis management, alerting, and coordination with external stakeholders.

Should you pay the ransom in the event of a ransomware attack?

The Federal Office for Information Security and the law enforcement authorities advise against paying ransoms. The reasons are practical and not merely a matter of principle: a payment guarantees neither a working decryption key nor a complete recovery, and it does not prevent the data leak – stolen data remains in the hands of third parties, regardless of any promises made.

There are also legal risks. Payments to sanctioned individuals, groups or states may breach sanctions law, which is almost impossible to rule out with certainty before a payment is made. Nor is reimbursement a given under insurance law, as policies treat ransom payments differently. And from an economic perspective, every payment further funds the business model that enables the next attack.

In practical terms, therefore, this question should not be raised for the first time when an incident occurs. A documented policy decision taken in advance by senior management – together with the involvement of law enforcement, specialist service providers and, where appropriate, the insurer – prevents decisions being made under extreme pressure. The first points of contact are the central cybercrime contact points at the State Criminal Police Offices; for some known ransomware families, the No More Ransom initiative also provides free decryption tools.

What reporting obligations apply following a ransomware attack?

A ransomware attack regularly triggers several reporting obligations simultaneously, which co-exist and have different deadlines and recipients.

Legal basis	Those affected	The essence of duty
Art. 33 and 34 GDPR	All those responsible	Report to the supervisory authority within 72 hours; notify data subjects in the event of a high risk
NIS-2	Key and important facilities	A multi-stage reporting process comprising an early warning, a follow-up report and a final report
DORA	Financial companies	Three-stage reporting of serious ICT incidents to the relevant authority
BSI Law	Operators of critical infrastructure	Reporting significant incidents to the BSI (Federal Office for Information Security in Germany)
Criminal law	All those affected	A criminal complaint may be lodged; it is recommended that the Central Cybercrime Co-ordination Unit be involved

Because deadlines are tight and recipients vary, sort out responsibilities, templates, and access to the reporting portals during the preparation phase rather than during the incident itself. The exact deadlines and responsibilities depend on the sector, size and national implementation and should be defined on an organisation-specific basis.

Summary: Key points on ransomware

• Ransomware is malware that encrypts or locks data or systems in order to extort a ransom – nowadays almost always following a prior data breach.
• Encryption comes at the end of the attack, not at the beginning; preceding it are days or even weeks of reconnaissance, privilege escalation and data exfiltration.
• The most common points of entry are phishing, compromised login credentials, unpatched systems exposed to the internet and unsecured remote access – rarely anything out of the ordinary.
• In cases of double extortion, the threat of data disclosure remains, even if all systems have been successfully restored.
• Ransomware-as-a-Service lowers the barrier to entry and leads to inconsistencies in the methods used within the same ransomware family.
• The destruction of backups is a planned stage of the attack; immutable or physically isolated backups are therefore crucial.
• Backups alone are not enough: they do not resolve either the data exfiltration or the issue of recovery time, which can only be addressed through practised restores.
• Following an attack, the sequence should be: isolate – secure evidence – rebuild rather than clean up; do not shut down systems prematurely.
• The authorities advise against paying ransoms: they offer no guarantee of recovery, do not stop the data exfiltration and carry the risk of regulatory sanctions.
• An attack triggers several reporting obligations simultaneously – under the GDPR and, depending on the sector, additionally under NIS-2, DORA or the BSI Act.