Ransomware Explained for Beginners: How It Gets In, What It Does, and What to Do First

A spreadsheet you used yesterday suddenly won't open. There's a new file on the desktop called something like HOW_TO_DECRYPT.txt, and when you look in your Documents folder, the same note is sitting there too. Nothing you click behaves the way it did this morning. Somewhere between your last save and now, ransomware got in and locked everything down.

Ransomware is malware that encrypts your files and holds them hostage, demanding payment for the key that unlocks them. The details change from one family to the next, but the shape of the attack rarely does. It arrives quietly, spreads while you're working on something else, and then announces itself all at once. Knowing the entry points and the first few moves after an infection is the difference between a bad afternoon and losing years of work.

What Ransomware Does Once It's Inside

Modern ransomware usually doesn't start encrypting the moment it lands. It sits still for a while — sometimes hours, sometimes days — while it maps the network, hunts through shared folders, and looks for backups it can destroy. Then it moves.

• Encrypts your files, from photos and invoices to databases and virtual machines, often leaving unfamiliar extensions on the filenames.
• Removes your escape routes by deleting shadow copies, emptying the recycle bin, and wiping any backup it can reach from the infected machine.
• Leaves a ransom note in every folder it touches, with instructions, a deadline, and a payment address.
• Steals data first in what's called double extortion, then threatens to publish it if you don't pay.
• Targets backups early, because an intact backup is the one thing that ruins the whole plan.

Encryption itself is fast. A home laptop might be done in minutes. A small business file server with years of shared documents can be locked before anyone notices the fans spinning harder.

How It Gets In

Almost every ransomware story starts with one of a handful of entry points. None of them are exotic.

• Phishing emails. A fake invoice, a shipping notice, a scanned document, a résumé with a password-protected attachment. The link leads to a convincing login page or a fake software update.
• Exposed remote access. Remote Desktop, a VPN appliance, or a management port reachable from the internet, protected by a weak or reused password. This is the single most common path into small businesses.
• Unpatched software. Routers, VPNs, email servers, and website plugins are all targets. Fixes exist for most of these flaws; the risk lives in the gap between release and installation.
• Pirated software. Key generators and "activated" installers often carry a loader that installs ransomware days or weeks later, once you've stopped thinking about it.
• Fake updates and downloads. Browser prompts, adverts, and sites offering a driver or codec you never asked for.
• USB drives and shared folders. Rarer than it once was, but still a reliable route onto machines that are behind on patches.

Two habits make every one of these far more dangerous: reusing the same password across accounts, and skipping multi-factor authentication. If your email account is protected only by a password you've used elsewhere, a single leaked database can hand an attacker the keys to everything attached to it.

The First Hour: What to Do Right Now

If you're reading this with an infected machine in front of you, work through these steps in order rather than improvising.

1. Cut the network connection. Unplug the Ethernet cable and turn off Wi-Fi. This stops the encryption from reaching shared drives and other devices.
2. Disconnect external drives and backups. Pull the USB cable on the drive you use for backups. Do it physically, not through software.
3. Decide about power carefully. If a technician may examine the machine, leaving it powered on can preserve useful information. If it's actively encrypting a shared folder, shut it down.
4. Photograph the ransom note and any error messages. Write down the file extension added to your files. Don't reply to the attackers and don't open any tool they offer.
5. Check your other devices. Look at phones, laptops, and shared drives. If your router or Wi-Fi password is old or weak, change it now.
6. Don't send money in a hurry. Paying doesn't guarantee a working decryption tool, and some attacks simply take the payment and go quiet. In some jurisdictions there are also restrictions on making these payments, so check with a professional before acting.
7. Report it and get help. Your national cybercrime reporting service takes these cases. If you run a business, contact your insurer and a lawyer — notification duties may apply if customer data was taken. Before assuming your files are gone, check a legitimate free resource such as No More Ransom, which hosts decryption tools for some ransomware families.

What Not to Do

Don't restore a backup onto a machine that hasn't been cleaned. You'll simply encrypt the backup too. Don't keep using the infected computer for email or banking, and don't assume a second device is safe just because it looks normal. It's also worth slowing down before wiping everything: make a list of what you actually need back, because once a drive is reformatted, your options shrink to whatever your backups hold.

Ignore websites promising instant decryption for a fee. Free tools exist and are usually shared openly; paid "recovery" offers that appear within minutes of an infection are almost always another way to take your money.

Backups, Passwords, and Patches

The 3-2-1 rule is still the best short version of good practice: keep three copies of important data, on two different types of media, with one copy kept offline or offsite. An external drive that stays plugged in is not an offline backup — ransomware will find it. Test a restore every few months. A backup you've never restored from is a hope, not a plan.

Beyond backups, a few small changes remove most of the easy routes in. Turn on multi-factor authentication for email and any remote access you use. Install updates when they're offered, especially for routers and anything that faces the internet. Use a password manager so no two accounts share a password. For a small business, restrict who can write to shared folders, keep an offline copy of your incident contacts, and give staff a way to report a suspicious email without embarrassment.

Prepare Now, While Nothing Is Wrong

Ransomware is unpleasant because it turns your own files into the weapon. The defence isn't complicated, but it has to exist before the ransom note shows up. Pick one thing to do today: connect that external drive and run a full backup, then unplug it and put it somewhere out of sight. Tomorrow, switch on multi-factor authentication for your main email account. Two small chores now will feel like very cheap insurance later.

Photo: cocoandwifi / Pixabay