Ransomware and Double Extortion
Skill packs and prompts are provided in English so they work best with the AI tools. Use them as-is.
Where you are: Unit V — Machines and Networks Under Attack · Lesson 5.2 (Section 5A — Malware: How Devices Are Attacked) · This lesson follows Chapters 13 and 14 of Dr. Al-Doori's Cyber Security Essentials, where the book describes ransomware and how to respond to it.
In Lesson 5.1 you met ransomware as one family on a list. It earns its own lesson because it is one of the most damaging attacks a person or a small organization can face, and because the right response has changed in an important way since the classic advice was written.
What you'll be able to do
Explain how modern ransomware works and what to do before and after an attack. By the end of this lesson you will be able to:
- describe how ransomware locks files and why modern attacks also steal them first;
- explain why authorities advise against paying, and what backups can and cannot fix;
- follow a calm, ordered set of steps if a ransom note ever appears on your screen.
How Ransomware Works
Ransomware is malware that makes your data unusable and then demands payment to give it back. Most often it uses encryption: it scrambles your files with a secret key so that, without that key, they look like nonsense. The criminals then display a ransom note, usually with a deadline and a demand for payment in cryptocurrency, which is harder to trace than a bank transfer.
Ransomware gets in through the same doors as other malware, which Lesson 5.3 covers in detail: a malicious link or attachment, a fake download, or a weakness in software that was never updated. Once inside, it often spreads to any drive or shared folder it can reach. That detail matters later, when we talk about backups.
As Dr. Al-Doori points out, a ransom note is not always telling the truth. Sometimes the threat is a bluff and the files are untouched; sometimes they really are encrypted. Either way, the note is designed to make you panic, and panic is exactly what you should avoid.
Double Extortion: Locked and Stolen
Classic ransomware had one threat: "Pay, or you will never see your files again." Modern ransomware usually has two. The US Cybersecurity and Infrastructure Security Agency (CISA) and the FBI describe attacks in which criminals first copy your data, then encrypt it, and then threaten to publish what they took if you do not pay. This is called double extortion.
Remember the CIA triad from Lesson 1.2. Encryption attacks availability: you cannot use your files. Data theft attacks confidentiality: other people can see them. A good backup can give you your files back, so it solves the availability problem. It cannot make stolen information private again. In short: backups restore your files, but not your privacy.
This is why prevention still matters even if your backups are perfect. Updates, careful clicking and strong account protection reduce the chance that criminals get in and copy anything at all.
Should You Pay?
The FBI's position is clear: it does not support paying a ransom. Its Internet Crime Complaint Center (IC3) explains that paying does not guarantee you will get your data back. Dr. Al-Doori's book makes the same point from the victim's side: there is no guarantee a criminal will keep their word, and paying can invite further scams.
Under double extortion there is an extra problem: even if criminals send a key, you have no way to make sure they have deleted the copy of your data. Refusing to pay is also common in practice: Verizon's 2026 Data Breach Investigations Report found ransomware in about 48% of the breaches it studied, and about 69% of ransomware victims in its data did not pay.
Before an Attack: Make Ransomware Survivable
- Keep backups, and keep one offline. The FBI advises keeping backups that are not connected to your computer or network, because ransomware attacks any drive it can reach. Lesson 5.5 shows you how to set this up with the 3-2-1 rule.
- Turn on automatic updates for your system, apps and browser, so known weaknesses are closed (Lesson 5.4).
- Keep built-in protection on. Windows and macOS include built-in antivirus, and Android includes Google Play Protect; these can catch some malware before it runs.
- Pause before clicking. Many attacks begin with a message that uses fear or a reward to rush you (Lessons 3.1 and 3.2).
After an Attack: What to Do
If a ransom note ever appears, work through these steps calmly:
- Do not pay and do not reply. Contacting the criminals rarely helps and can mark you as a willing target.
- Keep your backups disconnected. If a backup drive is plugged in, unplug it now and leave it unplugged until the device is clean.
- Record what you see. Photograph the ransom note with another device. Lesson 6.1 explains why simple records like this help later.
- Report it. In the US, report to the FBI through IC3; elsewhere, use your national police or cybercrime reporting service. Reporting is part of the official FBI and CISA advice, whether or not you lose anything.
- Look for a free decryptor. The No More Ransom project, run by Europol, the Dutch police and partners, offers free decryption tools for some ransomware families. It will not have one for every attack, but it is worth checking before you assume your files are lost.
- Clean or reset the device, then restore your files from a backup made before the infection.
- Assume data may have been copied. Change passwords for accounts you used on that device, and watch for follow-up scams that use stolen details (Lesson 6.2).
Real-World Example
Imagine Lina, a freelance designer. One Monday her laptop shows a note: her client files are encrypted, she has five days to pay, and the criminals say they have copied her folder of client contracts.
Lina does not reply. She unplugs her laptop from the network, photographs the note with her phone, and reports it. She checks No More Ransom, which has no tool for this variant. Because she keeps an external backup drive that she plugs in only once a week, and it was in a drawer that day, she resets the laptop and restores her work: her availability problem is solved.
Her confidentiality problem is not. The contracts may still leak, so she tells affected clients what happened and changes her account passwords. Her backup saved her business; it could not undo the theft. That is double extortion in one story.
From the Book to 2026
What the book teaches. Dr. Al-Doori describes ransomware as malware that encrypts your data and demands a hard-to-trace payment, with recovery nearly impossible without the key. He advises never paying and explains that diligent backups turn ransomware from a catastrophe into a nuisance.
Why it made sense. For attacks that only encrypted files, a good backup really did remove the criminal's leverage, and refusing to pay remains the official advice.
What has changed. Security guidance has evolved since the original text. Most serious ransomware now uses double extortion, so a backup no longer removes all the leverage: stolen data can still be leaked. Payment is demanded in various cryptocurrencies, and free decryptors now exist for some families through No More Ransom.
What to do now. Current guidance now recommends offline, tested backups, prompt updates and built-in protection before an attack; and after one, not paying, reporting the attack (IC3 in the US, or your national service), checking No More Ransom, and treating the incident as a possible data theft as well as a lockout.
Watch: Protecting Yourself from Ransomware
This short video from IBM Technology is one of the few on ransomware aimed at individuals rather than companies, and its four habits match this lesson closely.
As you watch, notice:
- how the presenter opens with the two kinds of threat, "I won't give your data back" and "I'll give it to the world", which is double extortion in plain words;
- why he keeps one backup drive disconnected and rotates it, so that an infection cannot reach every copy;
- his advice to type your bank's address yourself instead of clicking a link in an alarming message.
The video reinforces what you just read — the lesson is complete without it.
What Would You Do?
You run a small family business. A ransom note appears on the office computer, saying files are encrypted and customer records have been copied. A relative says: "We have backups. Just restore and forget about it." What would you do, and in what order?
Knowledge Check
You restored every file from a clean offline backup after a ransomware attack, and the note said data had been copied. What is the remaining risk?
Why do authorities advise keeping at least one backup disconnected from your computer?
A ransom note gives you 48 hours. Which first action is best?
Answers explained
What Would You Do? Restoring is part of the answer, but not all of it. In order: do not pay or reply; keep backups unplugged; photograph the note; report the attack; check No More Ransom; clean or reset the computer and restore from a backup made before the infection. Then deal with the second threat: the note says customer records were copied, so this is also a possible data breach. Change passwords used on that computer, warn customers about possible follow-up scams, and check what your local rules say about notifying people whose data was taken.
Question 1 — d. A backup brings your files back but cannot make stolen data private again; that is the core lesson of double extortion. Option a ignores the theft. Option b is not the case here: the backup was offline and clean, which is exactly why it survived. Option c misses the point, because the deadline is a pressure tactic, while the leak of copied data is the real remaining risk.
Question 2 — a. Ransomware attacks whatever it can reach, so a copy that is unplugged when the attack happens survives. Durability (b) and speed (d) are not the reason for the advice, and cloud services (c) set no such rule; the concern is simply reach.
Question 3 — c. The FBI does not support paying, payment guarantees nothing, and deadlines are designed to create panic, so paying fast (a) is not the answer. Negotiating (b) still means engaging with criminals and moving toward payment. Deleting the note and carrying on (d) leaves the malware in place, destroys a useful record and skips reporting.
Key Takeaways
- Ransomware scrambles your files and demands payment; most modern attacks also steal data first and threaten to leak it (double extortion).
- Backups restore your files, but not your privacy.
- The FBI does not support paying a ransom, and payment guarantees nothing.
- Before an attack: offline backups, automatic updates, built-in protection and careful clicking.
- After an attack: do not pay, disconnect backups, record, report, check No More Ransom, clean and restore, and treat it as a possible data theft.
Further Study
Optional and external; the lesson is complete without it.
- What is Ransomware? (IBM Technology) — a short companion that explains the two kinds of extortion and why backups matter. Some of its later advice is aimed at organizations rather than individuals.
Sources
- CISA, FBI, NSA and MS-ISAC — #StopRansomware Guide
- FBI Internet Crime Complaint Center (IC3) — Ransomware
- Europol, Dutch Police and partners — No More Ransom
- Verizon Business — 2026 Data Breach Investigations Report, Executive Summary (data)
- Dr. Tahseen Al-Doori — Cyber Security Essentials, Chapters 13 and 14