Ransomware: What Really Happens When Hackers Lock Your Files

The 30-second explanation

Attackers get in quietly, look around, find what matters, and only then lock everything and demand money. The loud part is the end, not the beginning.

How it works

1. 1

   1. Get in

   Phishing, an exposed service, or a stolen login.

2. 2

   2. Look around

   Find servers, data and backups.

3. 3

   3. Take data

   Copy sensitive files out first.

4. 4

   4. Lock files

   Encrypt systems and leave a ransom note.

When people picture ransomware, they picture a screen suddenly saying files are locked. That moment is real, but it is usually the end of a story that started days or weeks earlier. First, the attacker gets a foothold, often through a stolen password or a malicious attachment. Then they explore quietly, working out where the important files and backups are. Often they copy data out before locking anything, so they can threaten to publish it. Only then do they lock the files and leave a note demanding payment.

Real-world example

How to spot it

• Unfamiliar admin activity

  Administration tools running on machines that don't normally use them.

• Large, unexplained transfers

  A sudden burst of data leaving to an unfamiliar destination.

• Security tools going quiet

  Backup jobs or protection software being disabled without a reason.

• Mass file changes

  Many files being renamed or modified in a short window.

What to do

1. 1Isolate affected machines from the network as soon as something looks wrong — don't wait for confirmation.
2. 2Preserve evidence and involve incident response before restoring from backup.
3. 3Keep backups offline or immutable, so they cannot be reached from a compromised account.