Ransomware
Ransomware is malware that encrypts a victim's files or locks their system, then demands crypto in exchange for the key — a top-tier threat to businesses today.
Prevent Ransomware Distribution
Block bots spreading ransomware campaigns
What is Ransomware?
Ransomware encrypts a victim's files or systems and demands payment for the key. It is the most financially damaging category of malware in operation, because it converts a technical compromise directly into a payment demand.
Modern campaigns rarely stop at encryption. The standard model is double extortion: the data is stolen first and encrypted second, so refusing to pay still carries a threat of publication. That change matters, because it means good backups no longer make you immune — they make you able to recover, which is a different thing.
How an attack unfolds
| Stage | What happens |
|---|---|
| Access | A phished credential, an exposed remote-access service, or a compromised supplier |
| Reconnaissance | Days or weeks mapping the network, often with legitimate administration tools |
| Escalation | Domain administrator rights, which is what makes the later stages fast |
| Exfiltration | The data is copied out, for the second half of the extortion |
| Sabotage | Backups located and destroyed first, then encryption triggered across the estate |
The backup stage is the one organisations consistently fail to plan for. Backups reachable with the credentials the attacker now holds are not backups, and that discovery is routinely made during the incident.
Where it comes from
Not from your website. Ransomware arrives through email, exposed RDP and VPN endpoints, unpatched edge devices, and compromised software supply chains. There is no plausible path from a web form to an encrypted file server, and any vendor implying otherwise is selling a category it does not cover.
Being straightforward about this: Prosopo does nothing about ransomware. We stop automated traffic reaching your forms and APIs. The controls below are the ones that matter for this threat, and none of them are ours.
What actually works
- Offline, tested backups. Immutable or genuinely offline, with a restore you have rehearsed. This is the single factor that determines whether an attack is an incident or an existential event.
- Phishing-resistant authentication on email, VPN and administrative access. See multi-factor authentication — hardware keys, not SMS codes.
- Patch the edge first. Internet-facing VPN appliances, firewalls and file-transfer products are where the access is bought and sold.
- Remove standing administrative privilege. The escalation stage is what turns one machine into the whole estate.
- Segment the network so lateral movement is visible and bounded.
- Have a written incident plan, including who decides, who talks to regulators, and the legal position on payment. Deciding any of that under pressure goes badly.
On whether to pay: it funds the next campaign, marks you as a paying target, carries sanctions exposure depending on the group, and buys a promise from criminals. Both the UK's National Cyber Security Centre and the FBI advise against it.