Ransomware
Ransomware is malware that encrypts a victim's files or systems and demands payment (usually cryptocurrency) for the decryption key. Modern ransomware groups also exfiltrate data before encrypting and threaten to publish it — a tactic called double extortion.
Frequently Asked Questions
What is Ransomware?
Ransomware is malware that encrypts a victim's files or systems and demands payment (usually cryptocurrency) for the decryption key. Modern ransomware groups also exfiltrate data before encrypting and threaten to publish it — a tactic called double extortion.
How is Ransomware related to C2 (Command and Control)?
Ransomware and C2 (Command and Control) are both key concepts in threat intelligence. A Command and Control server is infrastructure used by attackers to remotely control compromised hosts (a botnet) and deliver instructions, exfiltrate data, or push malware updates. Blocking C2 communications is one of the most effective ways to disrupt an active attack.
Related Terms
C2 (Command and Control)
A Command and Control server is infrastructure used by attackers to remotely control compromised hosts (a botnet) and deliver instructions, exfiltrate data, or push malware updates. Blocking C2 communications is one of the most effective ways to disrupt an active attack.
IOC (Indicator of Compromise)
An indicator of compromise is an indicator supported by evidence of compromise or malicious activity. Security teams use IOCs to detect, contain, and investigate threats; an arbitrary IP address, domain, URL, file hash, or email address is only an observable until evidence supports that promotion.
Double Extortion
Double extortion is a ransomware tactic where attackers both encrypt and exfiltrate victim data, then threaten to publish the stolen data on a leak site if the ransom is not paid. This creates pressure on victims even if they have functional backups.
Put this intelligence to work
Query indexed indicators — IPs, domains, URLs, and hashes — in seconds.