Ransomware: Threats & Defense.

Ransomware is malware that encrypts victim data and demands payment for the decryption key. Modern variants use double extortion tactics.

• WannaCry (2017): Exploited EternalBlue, affected 150+ countries
• NotPetya (2017): Destructive worm disguised as ransomware
• Ryuk: Targeted large organizations for high-value payouts
• LockBit: Continues to evolve and target enterprises

• Backups: Immutable, offline, tested for recovery
• Segmentation: Limit lateral movement
• EDR: Detect suspicious behavior early
• MFA: Prevent credential-based lateral movement
• Patching: Keep systems updated

1. Isolate affected systems
2. Preserve evidence
3. Assess damage scope
4. Decide on reporting/recovery
5. Document lessons learned