Ransomware
Malware locks or encrypts your systems and demands payment, often after stealing the data so the attacker can threaten to publish it too.
See it
What it is
Ransomware is malware that blocks access to systems or encrypts data, then demands payment for restoration. Many operators also steal data first and threaten to publish it, so restoring from backup may fix the outage without ending the breach. WannaCry made the pattern globally visible in 2017 by spreading through unpatched Windows systems. Colonial Pipeline paid the DarkSide crew roughly $4.4 million in 2021 and still halted fuel delivery for days while it rebuilt.
Prepare before there is a ransom note: patch exposed services, require MFA, limit administrative access, segment networks, monitor endpoint behavior, and keep recoverable copies of important data. The response plan should say who can isolate a device, disable credentials, preserve evidence, restore each critical service, and handle legal and customer notifications.
The gotcha is calling any successful backup a ransomware backup. Malware with the same credentials can encrypt or delete online copies, and a clean backup is useless if restoration takes longer than the business can survive. Keep an offline or immutable copy, protect its administration separately, and run timed restore drills that rebuild a real service.
Ask AI for it
Create and implement a ransomware readiness plan for this system using the 3-2-1 backup technique. Put one backup copy in a separate AWS account with S3 Versioning and S3 Object Lock in Compliance mode, deny workload roles permission to delete or shorten retention, and protect backup administration with hardware-key MFA. Define alerts for mass file rewrites, backup deletion attempts, and unusual AWS KMS Decrypt volume. Write an incident runbook with named steps to isolate affected hosts, revoke sessions and credentials, preserve evidence, assess data theft, and rebuild from known-clean images. Finish with an automated monthly restore drill that recovers one production-sized service into an isolated account, checks data integrity, records recovery time, and fails when the measured RTO is missed.