Ransomware Basics for Everyone
Backups, least privilege, and what to do if files are locked.
Ransomware encrypts files and demands payment, sometimes after stealing data for double extortion. Infections often start with phishing, exposed remote desktop, or unpatched VPN appliances—not Hollywood zero-days.
Prevention beats recovery. Keep offline or immutable backups and test restores. Patch internet-facing systems quickly. Limit admin rights, enable MFA on remote access, and filter macros and unsafe attachments.
If hit, disconnect affected machines from the network, preserve evidence, and contact incident response or law enforcement guidance channels. Paying does not guarantee decryption and may mark you as a future target. Focus on restoring from clean backups and rotating credentials.
Home users should maintain versioned cloud or external backups disconnected after sync. Avoid pirated software cracks that bundle trojans. Ransomware is a business model; starve it with backups, least privilege, and cautious clicking.
Beyond the basics, build a personal security routine you can sustain. Once a month, skim login alerts, revoke stale sessions, and confirm backup jobs completed. Teach household members the same short checklist so one weak link does not undo everyone else's effort. When friends ask for help after a scare, walk them through password resets and MFA enrollment instead of only removing malware symptoms.
Threat actors automate reconnaissance. They scan for default credentials, outdated plugins, and cloud buckets left public. Your individual choices still matter because commodity attacks seek the easiest wins. Making your accounts boringly hard to abuse pushes opportunistic crime elsewhere. That is not victim blaming—it is practical risk reduction in an uneven landscape.