Ransomware is a type of malicious software that encrypts files on your device or network, then demands a payment, typically in cryptocurrency, in exchange for the decryption key. The question of what is ransomware and how you can recover your files after an attack is one of the most urgent questions in personal and business computing right now. Attacks have hit hospitals, schools, local councils, and home users. The good news: recovery is possible, and it doesn't always require paying the ransom.
How ransomware actually works
When ransomware runs on a device, it scans for documents, photos, spreadsheets, databases, and backups, then encrypts each file with a key that only the attacker holds. Within minutes, your data becomes unreadable. A ransom note appears, usually as a text file on the desktop or a changed wallpaper, with instructions on how to pay.
Most infections arrive through one of three routes: a phishing email with a malicious attachment or link, a compromised Remote Desktop Protocol (RDP) connection with weak credentials, or a vulnerability in unpatched software. The encryption itself is legitimate cryptography turned against the victim. Without the decryption key, brute-forcing the files is not realistic on modern encryption standards like AES-256.
Some ransomware strains also exfiltrate data before encrypting it, then threaten to publish it publicly if you don't pay. This is called double extortion, and it has become the standard tactic for groups like LockBit and BlackCat since roughly 2020. If you want to understand more about how attacks unfold from the attacker's perspective, the full picture of how ransomware attacks unfold and what businesses can do to stop them covers the threat model in depth.
What to do immediately after a ransomware attack
Speed matters. The decisions you make in the first 60 minutes determine how much you can recover.
- Disconnect from the network immediately. Unplug the ethernet cable or turn off Wi-Fi. This stops the ransomware spreading to other devices, network shares, or cloud-synced folders.
- Do not turn off the device yet. Volatile memory (RAM) can hold decryption keys or clues about the strain. Forensic analysts may be able to extract these if the machine stays on.
- Photograph the ransom note. Take a photo with your phone before you do anything else. The note contains the strain name, the payment address, and often a victim ID you'll need to identify decryptors later.
- Identify the strain. Upload a sample encrypted file and the ransom note to No More Ransom, a free tool run by Europol, the Dutch National Police, and cybersecurity firms. It matches your files against known strains and tells you if a free decryptor exists.
- Report the attack. In Australia, report to the Australian Cyber Security Centre (ACSC) at cyber.gov.au. In the UK, report to Action Fraud. In the US, report to the FBI's IC3. These agencies maintain databases of attack patterns and sometimes have decryption tools they share with victims.
Can you decrypt files without paying the ransom?
Sometimes, yes. It depends entirely on the strain.
Older or poorly implemented ransomware families have had their encryption cracked by security researchers. The No More Ransom project hosts free decryptors for over 160 strains, including older variants of Dharma, Stop/Djvu, and GandCrab. If your strain is on that list, decryption is free and straightforward. Run the tool, point it at your encrypted files, and it does the rest.
Modern strains from professional criminal groups are a different matter. Groups like LockBit 3.0 or BlackCat use correctly implemented asymmetric encryption, and no public decryptors exist for current versions. In those cases, your options narrow quickly: restore from backup, recover from shadow copies, or accept the loss of files you can't restore any other way.
Paying the ransom is a last resort for most security professionals, and not just for ethical reasons. Around 40% of victims who pay do not receive a working decryption key, according to data collected by the Coveware incident response firm. Even when the key works, decryption is slow, partial, or corrupted in some files.
Recovering files from backups
A clean, offline backup is the fastest and most reliable path to recovery. If you have one, the process is straightforward: wipe the affected machine, reinstall the operating system, verify the backup is clean (not infected), and restore.
The critical word is offline. Ransomware specifically targets connected backups, including external drives left plugged in, NAS devices on the same network, and cloud sync folders like OneDrive or Google Drive. If the ransomware ran long enough, those may be encrypted too. A backup that was disconnected before the attack is your strongest asset.
Cloud sync folders are not backups in the traditional sense. If ransomware encrypts files and the sync client pushes the encrypted versions to the cloud, you have a cloud full of encrypted files. Some cloud services, including Microsoft OneDrive and Google Drive, retain version history. You can roll back individual files to a pre-encryption version, but this is tedious and doesn't work if the version history window (typically 30 days) has closed. The difference between a sync and a true backup is exactly what the comparison between cloud backup and external hard drives gets into.
If you don't have a backup, check for Windows shadow copies. The Volume Shadow Copy Service (VSS) in Windows periodically snapshots the file system. Many ransomware strains delete shadow copies as part of the attack, but some don't, particularly less sophisticated ones. Right-click an encrypted file, select "Properties," then "Previous Versions." If anything appears there, you may be able to restore without a backup or a decryptor.
After recovery: closing the door
Recovery without remediation just sets you up for a second attack. Before reconnecting a cleaned machine to your network, work through the following.
First, identify how the attacker got in. If it was a phishing email, check whether other users clicked the same link. If it was RDP, change all credentials and consider disabling RDP entirely or placing it behind a VPN. If it was an unpatched vulnerability, patch it before the machine goes back online.
Second, audit your backup strategy. The goal is a 3-2-1 structure: 3 copies of important data, on 2 different media types, with 1 copy stored offsite or offline. Applying that structure before an attack makes recovery a one-hour job instead of a multi-day crisis. The 3-2-1 backup strategy explains exactly how to set this up.
Third, consider what data may have been exfiltrated. If the strain used double extortion, notify affected customers or staff according to your jurisdiction's data breach laws. In Australia, the Notifiable Data Breaches scheme requires notification to the OAIC if the breach is likely to cause serious harm.
Ransomware is a serious threat, but it isn't an unsolvable one. Most organisations and individuals who recover cleanly do so because they had a tested backup, acted quickly, and didn't panic into paying before exhausting free recovery options.