Ransomware · Visual IT Encyclopedia

Definition

Malware that encrypts files or restricts access to a system and demands payment for recovery to extort money

An example in which the attacker provides a decryption method and file recovery succeeds

Victim

Attacker

Victim:
Normal filesFiles can be opened
From Attacker to Victim:
Ransomware distribution
Victim:
Encrypted filesAfter infection and execution, encrypted files cannot be opened
From Attacker to Victim:
“Pay to recover your files”
From Victim to Attacker:
Payment
Attacker:
Receives the money
From Attacker to Victim:
Provides a decryption key or tool
Victim:
File decryptionUses the key or tool to reverse encryption
Victim:
Recovered filesFiles can be opened again

Paying does not guarantee file recovery.The attacker may not provide a decryption key, and recovery can fail even if a key is provided.