Malware and Ransomware Explained

TL;DR

• Malware is any software designed to do harm, such as stealing data, spying or damaging files. Ransomware is malware that locks your files, usually by encrypting them, and demands payment to unlock them [1][2].
• It usually arrives through email attachments, tricked downloads, unpatched software or infected USB drives [1][3].
• The best protection is boring: updates, security software, careful clicking and offline backups.
• Authorities do not encourage paying a ransom, because payment does not guarantee you get your files back [4].

The main types of malware #

"Malware" is a family name. Common members are [1]:

A trojan is named after the wooden horse: you let it in because it looks like a gift.

What ransomware does #

Ransomware encrypts files on a device so that they cannot be opened [2]. Criminals then demand payment for a decryption key, often in cryptocurrency. Some also copy your data first and threaten to leak or sell it if you do not pay [2][4]. Attackers typically get into a network first, take control, and only then switch on the encryption [4].

How malware spreads #

Common routes include [1][3]:

• Email attachments and links, often from phishing messages.
• Software downloads from ads or unfamiliar sites, including free music, films and games, and file-sharing sites [3].
• Software flaws that have not been fixed with an update.
• Drive-by downloads from compromised sites.
• USB drives and other external devices.
• Bundled software, where unwanted programs come packaged with something you chose to install.
• Weak passwords, which let attackers gain the access malware needs.

How to protect yourself #

1. Install updates for your system, browser and apps, and use security software with automatic scanning [1][3].
2. Be careful with unexpected email. Do not click links or open attachments you did not expect. Contact the company using a number or website you know is real [3].
3. Get software from the maker's own site or official app store, not from adverts [3].
4. Ignore pop-ups telling you to call tech support, and never call a number shown in a pop-up [3].
5. Scan USB drives before using them [3].
6. Use strong passwords and two-factor authentication [1].
7. Keep a recent backup, and keep it offline, so ransomware cannot reach it. The UK NCSC specifically recommends an offline backup of your most important files [4].

Signs of infection and what to do #

Signs include a slow or freezing device, redirected browser home pages, new toolbars, floods of pop-ups, or messages sent from your accounts that you did not write [3]. If you suspect malware, the FTC suggests you [3]:

1. Stop logging in to banking and shopping accounts until the device is clean.
2. Update your security software, then run a full scan.
3. Change your passwords, and turn on two-factor authentication.

If ransomware has locked your files, disconnect the device from the network, do not rush to pay, and report it. In the US report to ReportFraud.ftc.gov [3]. Organisations should contact their incident response provider [4].

FAQ #

What is the difference between a virus and malware? #

Malware is the broad term for harmful software. A virus is one type, which spreads by attaching itself to other files [1].

Should I pay a ransom? #

The UK NCSC and law enforcement do not encourage paying. There is no guarantee you will get access to your data, payment does not remove the infection, it funds criminals, and it may make you a target again [4].

Do Macs and phones get malware? #

Yes. Malware targets many kinds of device, so updates and cautious downloading matter on all of them [1][3].

Can antivirus catch everything? #

No. Security software helps, but it works best alongside updates, backups and careful habits [1][3].

Sources #