2.3 Malware and Ransomware Basics

Malware remains one of the most damaging threats to corporate environments,
with ransomware representing the most financially destructive variant.

• Ransomware Kill Chain:
  The typical lifecycle of a ransomware attack.
  1. Infection:
     The user clicks a malicious link or opens a compromised attachment.
  2. Staging:
     The malware establishes communication with the attacker’s command-and-control server.
  3. Encryption:
     Files on the system are encrypted and rendered inaccessible.
  4. Extortion:
     A ransom note appears demanding payment, typically in cryptocurrency.
• Double Extortion:
  Modern ransomware groups steal sensitive data before encrypting systems.

  
  If the victim refuses to pay for the decryption key, attackers threaten to
  publicly release stolen data. This tactic amplifies the impact by triggering
  regulatory penalties (such as GDPR fines) and severe reputational damage.