Five things you need to know about ransomware

Cybercriminals held the files and data of thousands of organizations worldwide for ransom in the last year. And that’s just incidents that have been confirmed—it likely reflects only a small share of the total number of organizations affected by ransomware attacks, in which hackers lock systems or data and demand payment to restore access. The threat is systemic: more than half of cyberattacks with known motives in the last year were motivated by extortion or ransom, according to the 2025 Microsoft Digital Defense Report (MDDR). 

Ransomware attacks have increased almost fivefold in the last five years, according to Foreign Policy Analytics. Similarly, in 2024, Microsoft found a 275% year-over-year increase in ransomware attacks. Ransomware has long been a profitable model for cybercrime, and in recent years it has become not only more lucrative but also easier to scale and increasingly difficult to attribute and prosecute. 

“Ransomware is the number one cyberthreat facing most organizations,” says Sherrod DeGrippo, General Manager of Global Threat Intelligence at Microsoft. DeGrippo explains that today, ransomware has become a societal issue on a global scale that has the potential to affect us all.  

How did we get here, and what will happen next? Here are five things you need to know about ransomware today. 

It started as a personal attack. Now it’s a societal threat. 

Ransomware has been around for a long time—the first documented case involved malware distributed on floppy disks in 1989. However, it did not become widespread until around 2016, when cybercriminals were sending emails infected with malware such as Locky at a rate of about a million messages a day. If a recipient opened the email, the files on their computer would be encrypted and they’d get a note demanding payment of about $300 in Bitcoin to unlock them. But it was fairly easy for people to wipe their computer, reinstall files from a backup, and ignore the ransom demand.  

Over time, cybercriminals hunting for a big payout began to look beyond individual users. They set their sights on entire organizations. By targeting cloud infrastructure, they could encrypt all of a company’s files at once, holding the entire organization hostage. Instead of just a few hundred dollars, they could demand millions. 

Even so, not every organization chooses to pay. As a result, by the early 2020s, attackers were looking for bigger, more reliable profits by targeting sectors where organizations can’t afford to have their operations disrupted, like healthcare, education, transportation, and other critical services. One metric of their success: a 2024 Microsoft survey found that 53% of healthcare organizations hit by ransomware attacks chose to pay—with an average payment of $4.4 million. 

The shift from targeting individuals to enterprise-level attacks that threaten not just company operations but everyday life and safety has made ransomware a pervasive threat. An attack on a hospital can delay urgent or critical care. Attacks on utilities can disrupt access to clean water or energy. Ransomware today affects us all, and addressing it has become a priority for government and law enforcement worldwide. 

Ransomware has become a robust—and resilient—industry. 

As ransomware attacks started to bring in more money, attackers became more organized. Ransomware evolved into a professionalized industry with a range of providers who specialize in specific elements of an attack. Some create the malware, and some are initial access brokers who sell various ways to break into networks, such as remote access credentials and phishing kits. There are ransom negotiators and groups that run “leak sites” that house stolen files. “There’s an entire supply chain that provides the weaponry for ransomware attacks,” DeGrippo says. 

Every part of that supply chain is more efficient now thanks to AI. The ability to create convincing forged documents, send automated phishing emails, and write ransom messages in any language enables ransomware groups to customize attacks on a significantly larger scale. 

The industrialization of ransomware makes it much harder to stop attacks. One reason is that many people consider it just a normal job. Leaked internal chat messages from the Russia-based Conti ransomware group reveal that members see themselves simply as developers who are engineering software for their employer. “Many of them are seen as upstanding people in their community because they have a computer job,” DeGrippo says. “These threat actors that are ransoming hospitals and putting lives at risk—they do not see it as criminal. They do not see a moral aspect.” 

This structure also makes it harder to identify and stop those responsible. When analysts discover a group that is active in the ecosystem, they have to determine whether it’s central to attacks or simply a peripheral part of the marketplace. But even when the most dangerous groups are identified, law enforcement rarely apprehends individual people. Microsoft’s Digital Crimes Unit most often disrupts cybercriminal operations by taking down their infrastructure, including domains, servers, and virtual computers, so they’re unable to operate. But since so much of that infrastructure can easily be bought and sold, the individuals just form new groups and start over.  

For that reason, governments and law enforcement have moved from reacting to individual attacks to focusing on disrupting the conditions that allow this market to thrive. Part of that is strengthening baseline cybersecurity across critical sectors. But ransomware groups also exploit legal gaps between jurisdictions, so cross-border cooperation is also an important factor.  

Coordinated law enforcement and public-private partnerships are much more effective in disrupting the ecosystem than any of these efforts would be on their own. Microsoft works with law enforcement as well as governments and policymakers on actions that raise costs for ransomware actors, slow their operations, and break up the different groups involved across the supply chain. Governments can build on that momentum by prioritizing information sharing, joint investigations, and deeper collaboration with industry.

There’s more than one way to ransom. 

The classic extortion model still works: attackers lock an organization’s files and demand a fee to decrypt them. But today, groups also steal, or exfiltrate, data and threaten to publish or sell it if the ransom isn’t paid.  

In recent years, attackers have combined these tactics. They exfiltrate the data first, then encrypt it, so they can pressure a company to pay to both get their data back and keep it from being sold on the dark web. To increase the pressure, they’ll also go through the stolen data to find the most sensitive or damaging information—for example, psychological profiles—and threaten to publicly release that specific information. “We call it multi-extortion,” DeGrippo says. “If you’re able to think diabolically enough, you can keep adding these multipliers and sweeteners to get more money.”

Ransomware actors are changing, and so are their tactics and motivations. 

Historically, most ransomware actors have operated out of countries, often in Eastern Europe, where they’re not prosecuted as long as they target victims abroad, so they’re able to operate with impunity. Addressing ransomware activity in these “safe havens” requires sustained use of diplomatic and economic levers to increase pressure and make it harder for these actors to function with impunity. This can help shift the economics of ransomware, making it a less attractive and less sustainable model over time. 

Recently, however, there has been a rise in Western ransomware groups that brings a new set of challenges. Many are comprised of young men operating out of a digital hub known as “The Com.” Unlike earlier groups, they are not always driven solely by profit. Some are also motivated by causing disruption and manipulation—and digital attacks often involve physical threats and violence. “They’ll get a local person to throw a brick through a window at their target’s house,” DeGrippo says, “and then they’ll send a text message and say, ‘I just threw a brick through your window. Are you gonna give me the password or not?’”

For most organizations, it’s not if they’ll face a ransomware threat, but when. 

DeGrippo advises all companies to assume their networks will one day be breached by a cybercriminal seeking a ransom. “You need a plan, and you need to run that plan in a mock scenario where it feels very real,” she says.  

An enterprise can’t wait for a ransom note to arrive to decide whether or not they’ll pay. The strategy must be defined well in advance, in collaboration with legal and financial departments. Importantly, organizations need to figure out how to remain operational, with minimal disruption, in the event of a ransom. That means knowing which systems can go offline in an attack and which must stay connected, and having reliable, verified file backups stored offline where they’re safe from encryption. The entire response plan must be accessible and actionable outside of the company’s network. “We have seen threat actors join the conference call where the incident about them is being discussed,” DeGrippo says. “You have to be able to get out of your network when you know there’s a threat actor in there.”  

Speed is of the essence in these situations. Dwell time, or the time a ransomware actor is in a company’s network, has dropped from weeks to days to hours. “Dwell time is critical because that’s how much time you have to detect the ransomware actor in your environment before they inflict damage,” DeGrippo says. An organization needs to figure out that the actor is there before they steal and decrypt files. The ransomware actor wants to encrypt as quickly as possible, but they have to exfiltrate the files first, “so that they have that ready to go if they want to do a next-level extortion,” DeGrippo says. “It’s a race against time on both sides.” 

The good news is that cybersecurity fundamentals provide solid ransomware defense. Implementing strong passwords and multi-factor authentication, training employees to recognize phishing and social engineering attempts, patching and updating aging software, and maintaining secure file storage and access management systems all improve resilience to ransomware. “Throughout history, we’ve seen the same pattern among criminals: they’ll look to do the bare minimum to be successful,” DeGrippo says. Security fundamentals are often enough to make a ransomware actor move on to an easier target. To learn more, read the MDDR’s top 10 cybersecurity recommendations for enterprises and watch Lisa Monaco in the Digital Front Lines Report.