Ransomware is malware that encrypts files on an infected computer and demands payment, often in cryptocurrency, to decrypt them. It is commonly spread through email attachments or malicious websites. section 11.2.1
Identify ransomware by its core behavior:
- Encrypts files or restricts access on an infected computer. section 11.2.1
- Demands payment in exchange for restoring access or decrypting files. section 11.2.1
- Often relies on user actions such as opening email attachments or visiting malicious websites. section 11.2.1
