Ransomware: What Regular People Need to Know

You open your laptop on a Sunday morning. Coffee’s still brewing. You were going to spend the next hour looking through old family photos. The ones from your daughter’s third birthday, the beach trip two summers ago. Ten years of memories, organized into folders the way you like them.

The screen is wrong.

The wallpaper has been replaced with something black. White text fills the center: YOUR FILES HAVE BEEN ENCRYPTED. You have three days to pay 0.012 Bitcoin, around $500, to a wallet address you’ve never seen before. After 72 hours, the decryption key gets deleted. Your files stay encrypted forever.

You double-click a photo folder out of reflex. The thumbnails are gone. Every image is now called something like IMG_4892.jpg.LOCK. The file won’t open. None of them open. Forty thousand photos from the last decade of your family’s life: birthdays, holidays, a parent who passed away two years ago. They are now corrupted-looking files with a random extension. They sit completely intact on your drive, locked behind someone else’s cryptographic key.

This happened to thousands of people last week. It will happen to thousands more next week. Ransomware is not a problem that lives inside corporations and hospitals. It lands on kitchen-table laptops, gaming PCs, and family iMacs constantly, and it destroys irreplaceable things.

The short answer: Ransomware is malware that encrypts your files and demands payment for the key. It gets in mostly through pirated software, phishing attachments, and unpatched vulnerabilities. The one defence that actually works is a backup ransomware cannot reach: keep a copy on an external drive you unplug, plus a versioned cloud backup. If you are already hit, disconnect from the internet, do not pay yet, and check nomoreransom.org for a free decryptor. Paying does not guarantee recovery and funds more attacks.

Jump to:

What Ransomware Actually Does to Your Files

The name describes the mechanism precisely: it holds your data for ransom. But understanding what happens at the file level matters, because it determines what your options are.

When ransomware executes on your computer, it begins scanning your drives for files worth encrypting. It targets documents, photos, videos, spreadsheets, PDFs, and database files: anything with personal or financial value. It deliberately leaves operating system files and executables alone. It needs Windows (or macOS) to keep running so you can see the ransom note and, from the attacker’s perspective, pay them.

The encryption it uses is real. It is not some weak scramble that can be reversed with a clever script. Modern ransomware uses AES-256 for the file contents, then wraps the decryption key itself in RSA-2048 or elliptic-curve encryption. Only the attacker holds the private key. Without it, your files are mathematically inaccessible. Brute-forcing 256-bit AES encryption with every computer on Earth would take longer than the age of the universe.

Once encryption is complete, the malware plants ransom notes — usually text files or HTML files — in every folder it touched. Then it changes your wallpaper, sometimes opens a countdown timer in a browser window, and waits. Some strains also delete Windows’ built-in backup system (called Volume Shadow Copies) in the same sweep, specifically to eliminate your easiest recovery option.

The ransom demand for individuals is usually modest by design: $200 to $1,000, often in Bitcoin or Monero. The calculation is deliberate. High enough to be worth running the operation. Low enough that paying feels easier than rebuilding from scratch.

The Criminal Business Model Behind This

Ransomware is not primarily written and deployed by the same person. The industry has professionalized in a way that would be darkly impressive if it weren’t so damaging.

The dominant model today is Ransomware-as-a-Service (RaaS). Criminal organizations build and maintain sophisticated ransomware toolkits, then license them to affiliates in exchange for a percentage of ransom payments — typically 20 to 30 percent. The affiliate deploys the ransomware, handles victim communication, and collects payment. The core group maintains the infrastructure, updates the malware to evade detection, and often operates a dark-web leak site where they publish stolen data from victims who refuse to pay.

LockBit, before its infrastructure was seized by an international law enforcement operation in February 2024, was the most prolific ransomware group in the world by victim count. At its peak, LockBit had over a thousand active affiliates. ALPHV (also called BlackCat), which operated until late 2023, was known for targeting healthcare systems and critical infrastructure. Ryuk, active from 2018 to 2022, specifically hunted large organizations and extracted tens of millions of dollars in ransoms. REvil (also called Sodinokibi) extorted Apple’s supplier Quanta Computer in 2021, demanding $50 million after stealing MacBook schematics.

These are the headline names. But the ransomware that targets regular people at home is usually different software from less-sophisticated operators. STOP/Djvu has been running since 2018 and has infected over 500,000 personal computers by current estimates. It spreads almost exclusively through pirated software and cracked games. It targets home users, asks for $200 to $980, and accounts for the majority of individual ransomware infections globally. You will not see it in news coverage of major ransomware attacks. It just quietly destroys people’s personal files by the thousands every month.

How Ransomware Gets Into Your Computer

There is no single entry point. Attackers use whatever works, and several vectors work very reliably against home users.

Phishing emails with malicious attachments remain the most common enterprise vector, but they hit individuals too. The email looks like an invoice, a shipping notification, a court document, or a bank statement. The attachment is a Word document or an Excel file, and it asks you to “Enable Content” or “Enable Macros” to view it properly. The moment you do, a macro runs a PowerShell command that downloads and executes the ransomware payload. Sometimes the attachment is a ZIP file containing an executable disguised with a PDF icon. Double-click it and it runs immediately.

Pirated software and cracked games are the dominant vector for consumer ransomware. This is not a vague warning — it is how STOP/Djvu and dozens of similar strains spread specifically. Cracked versions of Adobe Photoshop, Premiere, Microsoft Office, popular video games, and VPN software downloaded from torrent sites routinely contain ransomware bundled inside the installer. The crack works exactly as advertised. The ransomware runs silently in the background. You won’t know until your files are gone.

Drive-by downloads happen when you visit a compromised website or click a malicious advertisement. Your browser encounters code that exploits an unpatched vulnerability — often in the browser itself, in a plugin like Flash (defunct but still occasionally targeted), or in the operating system. The malware installs without any action from you beyond visiting the page. Keeping software updated is the primary defense against this vector.

Exposed Remote Desktop Protocol (RDP) is primarily an enterprise problem but affects home users who have remote access enabled on their machines. RDP is the service that lets you log into a Windows computer from another location. If it’s left on and exposed to the internet with a weak password, attackers run automated tools that try millions of credential combinations until they get in. Once inside, they deploy ransomware directly. The FBI’s Internet Crime Complaint Center flagged exposed RDP as a primary initial access vector in its 2023 Internet Crime Report.

What Happens in the Hours After Infection

The process is mostly invisible until it isn’t. Modern ransomware is optimized for speed — it can encrypt tens of thousands of files in minutes on a typical consumer hard drive, faster on an SSD.

In the background, before encryption begins, many strains do reconnaissance. They identify your operating system and check for virtual machine environments, to avoid security researcher sandboxes. They scan for network shares that can be encrypted too. Then they delete Volume Shadow Copies using a command like vssadmin delete shadows /all /quiet. That last step is significant. Windows creates automatic backups called shadow copies when you install updates or certain software. Many people think they can just restore from Previous Versions if something goes wrong. Ransomware specifically eliminates this option, usually in the first seconds of execution, before it starts touching your documents.

Then the encryption sweep begins. The malware generates a symmetric key, the one that actually scrambles your file contents. It encrypts that key with the attacker’s public RSA key. It then stores the encrypted version on your machine or sends it to a command-and-control server. Your file contents are scrambled. The symmetric key needed to unscramble them is locked. Without the private key the attacker holds, there is no mathematical shortcut to recovery.

The ransom note appears. The wallpaper changes. If you are home at the time, you might catch the file extensions changing in real time in an open folder window. It is one of the few visible signs something is happening.

Should You Pay?

The FBI’s official position is no. The logic: paying funds criminal operations, encourages more attacks, and doesn’t guarantee recovery.

For organizations with legal, regulatory, and reputational stakes, this guidance makes practical sense. It is messier for an individual. If you have no backups, and your only copies of a parent’s last year of photos are sitting encrypted on a laptop, the calculus is harder, and the FBI knows it.

Some ransomware groups operate with a strange professionalism. They provide functioning decryptors because their business model depends on reputation. If word spread that paying got you nothing, victims would stop paying. LockBit is a criminal enterprise responsible for billions in damage. Even so, it had a documented history of reliably providing decryption tools to paying victims. Security researchers tracked this as a notable operational trait. STOP/Djvu is less consistent: some victims get their files back, others do not.

Paying does not guarantee recovery. It funds future attacks. And it does not remove the malware from your machine, which means if you pay and restore without wiping the system, you may get encrypted again.

Before paying anything, check nomoreransom.org. This is a legitimate project run by Europol, the Dutch National Police, and cybersecurity companies. It hosts free decryption tools for hundreds of ransomware strains, contributed by researchers who reverse-engineered the encryption or obtained master keys from law enforcement takedowns. You may be able to recover your files for free if your ransomware is an older or defunct strain, or if a law enforcement action has exposed the keys. Upload your ransom note or one encrypted file to the site’s identification tool. It will tell you what strain you have and whether a decryptor exists.

The 2022 takedown of Hive ransomware included FBI infiltration of the group’s infrastructure. Agents covertly collected over 300 decryption keys, which were distributed to victims before the public takedown announcement. Similar results came from operations against REvil and Emotet. Checking nomoreransom.org costs nothing and takes five minutes.

The 3-2-1 Backup Strategy, in Plain Terms

The only complete defense against ransomware is a backup that ransomware cannot reach. Everything else — antivirus, firewalls, careful browsing — reduces your risk. Backups eliminate the leverage. If your files exist intact somewhere the malware couldn’t touch, the ransom demand means nothing. You wipe the machine, restore from backup, and lose an afternoon instead of everything.

The standard framework is 3-2-1: three copies of your data, stored on two different types of media, with one copy stored offsite.

In practice for a home user, this looks like:

Copy 1 — Your primary device. The files on your laptop or desktop. This is the working copy.
Copy 2 — An external drive, kept disconnected. This is the critical detail that most people miss. An external drive that stays plugged in will be encrypted alongside your local files — ransomware targets all connected storage. The backup drive needs to be physically disconnected when you’re not actively backing up to it. Plug it in, run a backup, unplug it. Once a week, or once a day if your files change frequently.
Copy 3 — Cloud backup, not cloud sync. These are different things and the distinction matters.

Google Drive, Dropbox, iCloud, and OneDrive are sync services. They mirror what’s on your machine to the cloud. Say ransomware encrypts your local files and your sync client uploads those encrypted versions before you notice. That happens, because ransomware can move faster than a slow sync cycle. Now your cloud copies are also encrypted. Sync services are useful, but they are not backups in the ransomware sense.

Cloud backup services keep versioned copies of your files, meaning they retain previous versions for a period of time even after the local file changes. Backblaze Personal Backup costs around $9 per month for unlimited storage and keeps 12 months of file history by default. That version history is the protection: even if the encrypted versions sync up, you can restore a pre-encryption version from the backup’s history. Acronis, iDrive, and Carbonite offer similar versioned backup approaches. Apple Time Machine with a network-attached drive, combined with iCloud, gets you partway there if configured carefully.

The one-offsite copy matters because local disaster — fire, flood, theft — can take out your machine and your unplugged external drive simultaneously. Cloud backup solves this automatically.

What to Do Right Now If You’re Already Infected

If you’ve opened your laptop and seen the ransom note, here is the sequence that gives you the best chance.

Disconnect from the internet immediately. Pull the ethernet cable or turn off Wi-Fi. This stops the ransomware from sending encryption keys back to command-and-control servers, which some strains do. It also stops lateral spread to other devices on your home network: your spouse’s laptop, your NAS, your connected external drives. Move quickly.

Do not turn the machine off. This sounds counterintuitive, but some strains store the encryption key in memory before transmitting it. Forensic analysis of RAM dumps has occasionally recovered keys. A cybersecurity professional or law enforcement would need to handle this, but turning the machine off ends that possibility.

Take a photo of the ransom note screen with your phone. For the nomoreransom.org identification process, you will need the ransom note text, any contact email addresses or dark web URLs, and the name of the ransomware strain if it’s listed.

Identify the strain. Go to nomoreransom.org from another device (not the infected machine). Use the Crypto Sheriff tool. Upload your ransom note or an encrypted file. The tool will identify the ransomware family and tell you whether a free decryptor exists.

Do not pay immediately. Give yourself time to check for free decryptors, consult with a data recovery professional, and think clearly. The 72-hour countdown is designed to create panic and short-circuit your decision-making. Some strains actually extend their deadlines on request; the countdown is partly theater.

If you have backups, do not restore from them onto the infected machine. Wipe the machine first — reinstall Windows from scratch, verify the machine is clean, then restore your files from backup. Restoring onto an infected system may result in re-encryption.

If you have no backups and no free decryptor exists, you have a difficult decision. A professional data recovery service may be able to help in edge cases — particularly if the ransomware had a programming flaw in its implementation. This has happened with several amateur strains. It is not reliable, but it exists as an option. Companies like Coveware specialize in ransomware response and can advise on whether payment or recovery has better odds in your specific situation.

Why Volume Shadow Copies Won’t Save You

Windows has a built-in feature called Volume Shadow Copy Service (VSS) that creates point-in-time snapshots of your drive. You can access previous versions of files by right-clicking them and selecting “Restore previous versions.” It is legitimately useful for accidental deletions and file corruption.

Ransomware authors know this feature exists and eliminate it immediately. The command vssadmin delete shadows /all runs in seconds with administrative privileges. So does wmic shadowcopy delete. Both are standard components of modern ransomware deployment, executed before encryption begins, before you have any indication something is wrong.

If you check Previous Versions on an encrypted file after a ransomware infection, you will find the history empty. The snapshots are gone. This is not a Windows failure — it is a deliberate step in the attack. Relying on VSS as your backup strategy means your backup strategy has been specifically anticipated and neutralized.

Prevention: What Actually Works

The security advice you’ve heard before — don’t click suspicious links, keep software updated — is real, but it’s incomplete without the specifics.

Keep Windows updated, and do it immediately. Ransomware exploits vulnerabilities in Windows components, Office, and browsers. Microsoft’s monthly Patch Tuesday updates close these gaps. The WannaCry ransomware attack in 2017 that disabled NHS hospitals across the UK exploited a Windows vulnerability (EternalBlue) for which Microsoft had released a patch 59 days earlier. The hospitals hadn’t applied it. This pattern repeats constantly. Automatic updates should be on.

Do not run pirated software. This is the one. Cracked Photoshop, cracked Office, cracked games — these are the primary delivery mechanism for STOP/Djvu and dozens of similar consumer ransomware strains. The risk is not theoretical. It is the main vector by which home users get infected. If you’re running cracked software, you are playing a form of lottery where the prize is encrypted files.

Disable Office macros by default. Microsoft Office macros are the delivery mechanism for a large share of email-attachment ransomware. Open a malicious Word document, click “Enable Content,” and a macro silently downloads and executes the payload. In Office 2016 and later, macros from the internet are now blocked by default and require explicit administrator action to enable. Verify this is the case on your machine. You can check in any Office application under File > Options > Trust Center > Trust Center Settings > Macro Settings. “Disable all macros with notification” is the right setting.

Enable Controlled Folder Access. This is a Windows Security feature that prevents unauthorized applications from modifying files in protected folders (Documents, Pictures, Videos, Desktop, and others you specify). You enable it in Windows Security > Virus & Threat Protection > Ransomware Protection > Controlled Folder Access. When ransomware tries to encrypt files in those folders, it gets blocked. The feature is off by default. Turning it on is one of the most direct ransomware mitigations built into Windows at no cost.

Use Windows Defender, and don’t assume you need to replace it. Windows Defender (now Microsoft Defender Antivirus) is substantially more capable than it was five years ago. Independent testing from AV-TEST and AV-Comparatives consistently rates it as adequate protection for home users. It detects known ransomware strains reliably. Paid antivirus products offer additional features but are not required for baseline protection. What Defender cannot protect against is what you install yourself — including cracked software that you’ve explicitly told your system to run.

Audit what’s on your network. Ransomware spreads laterally after infecting your primary machine. A NAS (network-attached storage device), a home server, or a Raspberry Pi accessible on your home network can all be targeted. Make sure they require authentication, are not exposed to the public internet, and have their own backup strategy.

The Version of This Story That Doesn’t Have a Bad Ending

The $500 ransom demand for a family’s photo archive is not a complex security failure. It’s the direct result of two decisions: running software from untrustworthy sources, and not maintaining a backup.

Both of those are fixable right now, today, before anything happens.

Set up Backblaze or an equivalent versioned cloud backup — it takes twenty minutes and $9 a month. Buy a 2TB external drive for $60, plug it in tonight to create a local backup, then disconnect it and put it in a drawer. Turn on Controlled Folder Access in Windows Security. Stop running pirated software. Apply pending Windows updates.

The backup especially. Everything else reduces your probability of getting infected. A proper backup eliminates the ransomware’s leverage entirely. The attacker holds a key to files they’ve encrypted on your machine — but if identical copies exist somewhere clean, that key is worthless. They’ve done considerable work for nothing.

The families who lose ten years of photos to ransomware are not less careful or less technically savvy than the families who don’t. They just hadn’t gotten around to setting up a backup yet. That gap is the entire attack surface. Close it before you need to.

The same infostealer malware that drops ransomware also scrapes your saved passwords and session cookies, which is a separate exposure worth checking. Our stealer logs explainer covers how to tell if your credentials have already leaked. KnytX Vigil is built to watch breach databases and stealer logs for your data and flag hits early. Vigil isn’t live yet; join the waitlist to turn it on at launch.