Ransomware in five steps

Step by step

1. Entry, often through a phishing email, a weak password or an unpatched system.
2. The attacker quietly explores the network.
3. They steal data and find the backups.
4. They encrypt files across many machines at once.
5. A ransom note appears.

How to reduce the risk

Keep offline backups and test restoring them, apply updates, turn on multi-factor authentication, and train people to spot phishing.