What is ransomware? How it works and how to protect your company

Octavio Mendoza
CISO at ZetTateK

The ransomware is a type of malware that encrypts a victim's files or systems and demands a payment (ransom) to restore access. It is now one of the costliest threats for companies: in addition to holding information hostage, attackers often steal the data and threaten to publish it if the ransom is not paid (so-called “double extortion”).

What is ransomware, and how does it work?

Ransomware gets into the network, spreads in search of valuable data and encrypts them with a key that only the attacker holds. It then displays a ransom note demanding payment, usually in cryptocurrency, in exchange for the decryption key. Without proper defenses and a plan, the company is paralyzed: no access to systems, email or critical information.

How does ransomware get into a company?

  • Phishing: emails with malicious links or attachments. It is the number one vector.
  • Stolen credentials: remote access (RDP, VPN) that is exposed or protected by weak passwords.
  • Unpatched vulnerabilities: outdated software that the attacker exploits.
  • Supply chain: through a compromised supplier or third-party software.

The phases of a ransomware attack

  • Initial access: the attacker gets in (phishing, credentials, exploit).
  • Lateral movement: spreads across the network and escalates privileges.
  • Exfiltration: steals data for double extortion.
  • Encryption: locks the systems and displays the ransom note.

The key to defense is to detect the attack in its early phases —before encryption—, and that is where EDR and a SOC 24/7 make the difference.

How do you protect your company from ransomware?

  • 24/7 detection and response: a EDR operated by a SOC detects the attack behavior before impact and isolates the affected device.
  • Backups and recovery: isolated, immutable backups make it possible to restore without paying. Understand the difference between Backup and Disaster Recovery.
  • Patching and access control: close vulnerabilities and enable multi-factor authentication (MFA) on all access points.
  • Awareness: trains the team to recognize phishing.
  • Incident response plan: having a tested protocol reduces recovery time and damage.

Should the ransom be paid?

The general recommendation from authorities and the industry is not to pay: it does not guarantee data recovery, it funds organized crime and it marks you as a target. The best stance is prevention and having recoverable backups and a incident response plan that lets you restore operations without negotiating.

Frequently asked questions

What is double extortion in ransomware?
It is a tactic in which attackers, in addition to encrypting the data, steal it beforehand and threaten to publish or sell it if the victim does not pay. This puts pressure even on those who have backups.
Does antivirus protect me from ransomware?
Traditional antivirus stops known variants, but modern ransomware evades it. Effective defense combines EDR with behavior-based detection, a 24/7 SOC and recoverable backups.
How does a company recover after a ransomware attack?
By containing the incident (isolating devices), assessing the scope, restoring from clean backups and applying an incident response plan. Having Disaster Recovery makes it possible to resume operations in hours instead of days.
Are SMBs targeted by ransomware?
Yes, increasingly so. Attackers know they tend to have weaker defenses and less response capability, which makes them profitable targets. No company size is exempt.

Protect yourself from ransomware with ZetTateK

At ZetTateK we combine EDR, a 24/7 SOC and incident response to prevent, detect and recover from ransomware in Mexico, Latin America and the United States. Request a free security assessment and measure your real exposure. Also explore our cybersecurity glossary.

Keep reading

Latest news