What is ransomware?

In practice, a ransomware attack blocks access to your data until a ransom is paid.

In fact, ransomware is a type of malware or phishing cyber security attack that destroys or encrypts files and folders on a computer, server, or device.

Once devices or files are locked or encrypted, cybercriminals can extort money from the business or device owner in exchange for a key to unlock the encrypted data. But even when paid, cybercriminals might never give the key to the business or device owner and stop access permanently.

How do ransomware attacks work?

Ransomware can be automated or involve human hands on a keyboard - a human-operated attack, such as seen in recent attacks using Conti and LockBit ransomware.

Automated ransomware attacks

Commodity ransomware attacks are often automated. These cyber attacks can spread like a virus, infect devices through methods like email phishing and malware delivery, and require malware remediation.

Therefore, you can safeguard your email system using Microsoft Defender for Office 365 that protects against malware and phishing delivery. Microsoft Defender for Endpoint works alongside Defender for Office 365 to automatically detect and block suspicious activity on your devices, while Microsoft Defender XDR detects malware and phishing attempts early.

Human-operated ransomware attacks

Human-operated ransomware is the result of an active attack by cybercriminals that infiltrate an organization's on-premises or cloud IT infrastructure, elevate their privileges, and deploy ransomware to critical data.

These "hands-on-keyboard" attacks usually target organizations rather than a single device.

Human-operated also means there's a human threat actor using their insights into common system and security misconfigurations. They aim to infiltrate the organization, navigate the network, and adapt to the environment and its weaknesses.

Hallmarks of these human-operated ransomware attacks typically include credential theft and lateral movement with an elevation of the privileges in stolen accounts.

Activities might take place during maintenance windows and involve security configuration gaps discovered by cybercriminals. The goal is the deployment of a ransomware payload to whatever high business impact resources the threat actors choose.


These attacks can be catastrophic to business operations and are difficult to clean up, requiring complete adversary eviction to protect against future attacks. Unlike commodity ransomware that usually only requires malware remediation, human-operated ransomware will continue to threaten your business operations after the initial encounter.

The impact and likelihood that human-operated ransomware attacks will continue

Ransomware protection for your organization

First, prevent phishing and malware delivery with Microsoft Defender for Office 365 to protect against malware and phishing delivery, Microsoft Defender for Endpoint to automatically detect and block suspicious activity on your devices, and Microsoft Defender XDR to detect to malware and phishing attempts early.

For a comprehensive view of ransomware and extortion and how to protect your organization, use the information in the Human-Operated Ransomware Mitigation Project Plan PowerPoint presentation.

Here's a summary of the guidance:

The summary of the guidance in the Human-Operated Ransomware Mitigation Project Plan

  • The stakes of ransomware and extortion-based attacks are high.
  • However, the attacks have weaknesses that can reduce your likelihood of being attacked.
  • There are three steps to configuring your infrastructure to exploit attack weaknesses.

For the three steps to exploit attack weaknesses, see the Protect your organization against ransomware and extortion solution to quickly configure your IT infrastructure for the best protection:

  1. Prepare your organization to recover from an attack without having to pay the ransom.
  2. Limit the scope of damage of a ransomware attack by protecting privileged roles.
  3. Make it harder for a threat actor to access your environment by incrementally removing risks.

The three steps to protecting against ransomware and extortion

Download the Protect your organization from ransomware poster for an overview of the three phases as layers of protection against ransomware attacks.

The "Protect your organization from ransomware" poster

Additional ransomware prevention resources

Key information from Microsoft:

Microsoft 365:

Microsoft Defender XDR:

Microsoft Defender for Cloud Apps:

Microsoft Azure:

Microsoft Security team blog posts:

For the latest list of ransomware articles in the Microsoft Security blog, click here.