Ransomware: What Actually Helps

Ransomware is the one category where the usual advice inverts. Detection matters, but the thing that determines whether an incident is an afternoon of annoyance or a permanent loss is decided before the attack starts — by whether a copy of your data exists somewhere the attacker could not reach.

What happens, in order

Initial access. An attachment, a fake installer, a malicious advert, or more often now a stolen or reused credential used to log in legitimately. Nothing exotic is required.

Enumeration. The program maps what it can reach: local drives, attached external disks, network shares, and synchronised cloud folders. This is the moment a behavioural engine has its cleanest signal, because mass enumeration followed by mass writes is a very specific pattern.

Backups attacked. Before encrypting anything, competent ransomware deletes Volume Shadow Copies, disables recovery, and looks for backup files to destroy. The attacker knows as well as you do what determines whether you pay. Windows tamper protection and behaviour rules that specifically watch for shadow-copy deletion exist because of this step.

Encryption. Files are rewritten, usually in a prioritised order that starts with documents and images. On a modern machine this is fast. A process halted midway leaves you with a partially encrypted set, which is better than the alternative and still a real loss.

The demand. Increasingly accompanied by a threat to publish data the attacker copied out first — so-called double extortion, which means that restoring from backup solves the availability problem but not the confidentiality one.

The backup rule that actually matters

The traditional formulation is 3-2-1: three copies of your data, on two different kinds of media, with one copy off-site. It predates ransomware and needs one addition to survive it.

Two practical notes that catch people out:

• Cloud sync is not backup. If a file is encrypted locally, the sync client faithfully replicates the encrypted version. What saves you is the provider’s version history — check how far back it goes and whether you can restore a whole folder at once, before you need to.
• An untested backup is a hypothesis. Restore something from it. The failure modes — a corrupt archive, a forgotten passphrase, a job that silently stopped months ago — are only discovered by trying.

Reducing the chance it starts

1. Patch promptly. Automatic updates for the operating system, the browser and anything internet-facing. This does more than any product you can buy.
2. Unique passwords plus two-factor authentication on email above all, since email is the reset mechanism for everything else. See our passwords guide.
3. Do not work as an administrator. A standard account limits what a successful infection can reach without a further step.
4. Turn on controlled folder access if you run Windows. It restricts which applications may write to your documents, and it is built in and free.
5. Treat macro-enabled documents as executables. Because that is what they are.
6. Close what you do not use. Remote desktop exposed to the internet is a recurring root cause in real incident reports.

If it happens

1. Disconnect the machine from the network and from any external drive. Immediately. Unplug the cable or turn off the adapter.
2. Do not reboot or wipe before deciding. Some families leave key material in memory, and evidence on disk may matter later.
3. Photograph the ransom note. The family name in it determines whether a free decryptor exists.
4. Check No More Ransom, the joint Europol and industry project that publishes free decryption tools for families whose keys have been recovered.
5. Report it. To your national cybercrime authority, and — if personal data of others was affected — to your data protection authority within 72 hours, as Article 33 GDPR requires.
6. Restore from a clean backup onto a rebuilt system. Restoring onto a machine that may still carry persistence is how people get encrypted twice.

Sources

• No More Ransom — free decryptors, run by Europol with industry partners.
• NCSC ransomware guidance — UK National Cyber Security Centre.
• CISA StopRansomware — US guidance and the joint ransomware guide.
• ENISA Threat Landscape — observed trends in the EU.
• Microsoft: controlled folder access — documentation for the built-in Windows feature.

Written by Isla Ward, Director of publication for BohDo Fast Transport s.r.o.. Published and last reviewed 22 September 2026. General information, not security advice tailored to your circumstances. All diagrams on this page are original SVG files produced for savorin.online. Editorial policy and corrections procedure.