Ransomware is a cyber extortion attack where adversaries encrypt or exfiltrate organizational data and demand payment for restoration or to prevent public disclosure. Unlike isolated malware incidents, modern ransomware operates as a business model — Ransomware-as-a-Service (RaaS) ecosystems enable even non-technical threat actors to launch sophisticated attacks. Defense requires layered prevention controls, rapid detection mechanisms, and practiced recovery procedures — because successful ransomware attacks rarely result from a single security failure, but rather from chained compromises across identity, access, and data protection layers.
What This Cheat Sheet Covers
This topic spans 15 focused tables and 149 indexed concepts. Below is a complete table-by-table outline of this topic, spanning foundational concepts through advanced details.
Table 1: Common Attack Vectors
Almost every ransomware incident starts with one of these doorways in — and the list is dominated by identity and remote access far more than by exotic zero-days. Phishing, exposed RDP, and stolen credentials still account for the bulk of real-world breaches, which is why closing these few vectors blocks most attacks before they ever reach the encryption stage.
| Vector | Example | Description |
|---|---|---|
Malicious Office macro in invoice.docx delivered via email | • Deceptive messages with weaponized attachments or links that initiate payload delivery • remains top initial access method despite security awareness training | |
Brute-force attack on exposed RDP port 3389 with weak credentials | • Remote Desktop Protocol services exposed to internet become entry points for credential stuffing • Microsoft warned of increased RDP phishing attacks in April 2026 | |
Trojanized npm package delivering RAT to developers | • Malicious code injected into trusted software dependencies or update mechanisms • Axios npm compromise in March 2026 impacted 100M+ weekly downloads | |
Exploiting unpatched Fortinet or Cisco VPN appliance CVE | Attackers target zero-day or unpatched vulnerabilities in remote access infrastructure to establish initial foothold | |
Harvested credentials from phishing campaign reused across network | • Stolen usernames and passwords enable lateral movement • identity-first attacks dominated 2026 ransomware campaigns |