Ransomware
Malware that encrypts your files and demands payment — usually in cryptocurrency — in exchange for the decryption key.
Also known as: crypto-locker, extortion malware
Last reviewed: 1 June 2026
Ransomware is a category of malware that locks you out of your own data by encrypting files, then presents a demand for payment, typically in Bitcoin or Monero, in exchange for the decryption key. Payments are demanded via the dark web or anonymous messaging channels.
Ransomware reaches victims through phishing emails, drive-by downloads from compromised websites, and exploitation of unpatched software vulnerabilities. In corporate environments, attackers often move laterally across networks before deploying the ransomware, maximising the damage — and the leverage.
Paying the ransom is not recommended: it funds criminal operations, there is no guarantee of receiving a working key, and the attackers may publish the stolen data anyway. Maintaining secure offline backups is the primary protection — if your data exists elsewhere, the ransom loses its power.