Ransomware Explained: How It Works, Key File Indicators, and the Threat Actors Behind It (Security+ Exam Prep)

 Ransomware Explained: 

How It Works and Who the Threat Actors Are 

(Security+ Exam Prep)

Ransomware is one of the most disruptive and costly cyber threats organizations face today. For Security+ candidates, mastering ransomware isn’t just about memorizing a definition, it’s about understanding the attack lifecycle, the motivations behind threat actors, and the defensive strategies that align with real‑world security operations.

This guide breaks down ransomware in a practical, exam‑focused way so you can confidently tackle related questions on the Security+ exam.

What Is Ransomware?

Ransomware is a type of malware that encrypts data or locks systems, demanding payment, usually in cryptocurrency, in exchange for the decryption key or restored access. It’s a form of cyber extortion, and it often brings business operations to a halt.

Security+ emphasizes ransomware because it intersects with multiple domains:

• Threat actors
• Malware behavior
• Incident response
• Business continuity
• Disaster recovery
• Risk management

Understanding ransomware means understanding how attackers infiltrate systems, how they escalate privileges, and how they monetize their attacks.

Common Ransomware File Extensions

Well‑Known Ransomware Families:

• .locky — Locky
• .crypt, .crypto — CryptoLocker variants
• .zepto — Locky variant
• .cerber — Cerber
• .wannacry — WannaCry
• .petya, .petyacrypt — Petya
• .ryuk — Ryuk
• .maze — Maze
• .revil, .sodinokibi — REvil/Sodinokibi
• .darkside — DarkSide
• .conti — Conti
• .phobos — Phobos
• .egregor — Egregor

Generic Extensions Used by Many Strains

These appear across numerous ransomware families:

• .encrypted
• .locked
• .enc
• .crypt
• .pay
• .pay2
• .ransom

Randomized Extensions

Many modern ransomware variants generate random strings as extensions, such as:

• .A1B2C3
• .xyz123
• .randomcharacters

This makes detection harder and prevents defenders from easily identifying the ransomware family.

Security+ rarely asks for specific extensions. Instead, it focuses on recognizing symptoms:

• Files renamed with a new extension
• Files unreadable or corrupted
• Ransom note appears (HTML, TXT, PNG)
• Encryption spreads across network shares
• Backups deleted or inaccessible

How Ransomware Works: The Attack Lifecycle

Ransomware attacks follow a predictable pattern. Security+ expects you to know the major phases:

1. Initial Access

Attackers gain entry through:

• Phishing or spear‑phishing emails
• Malicious attachments or links
• Exploit kits
• Vulnerable remote services (RDP, VPN)
• Drive‑by downloads
• Supply chain compromises

2. Execution

Once inside, the ransomware payload is executed. This may involve:

• Dropping an executable
• Running scripts (PowerShell, Python, batch files)
• Leveraging built‑in tools (living‑off‑the‑land techniques)

3. Privilege Escalation & Lateral Movement

Attackers move through the network to maximize impact:

• Stealing admin credentials
• Pivoting to servers
• Targeting backups
• Disabling security tools

This stage is critical because ransomware operators want to encrypt as much data as possible.

4. Encryption or System Lockout

The ransomware encrypts files using strong algorithms (AES, RSA) or locks the system entirely. Victims typically see:

• A ransom note
• Instructions for payment
• Threats of data destruction or public release

5. Extortion

Modern ransomware uses double extortion:

• Encrypt the data
• Exfiltrate the data
• Threaten to leak it if the ransom isn’t paid

Some groups even use triple extortion, targeting customers or partners of the victim.

6. Monetization

Attackers demand payment, usually via:

• Bitcoin
• Monero
• Other privacy‑focused cryptocurrencies

Types of Ransomware

Security+ expects you to distinguish between major ransomware types:

• Crypto‑ransomware: Encrypts files
• Locker ransomware: Locks the system interface
• Scareware: Fake warnings demanding payment
• Leakware/Doxware: Threatens to publish stolen data
• Ransomware-as-a-Service (RaaS): Subscription‑based ransomware sold to affiliates

RaaS is especially important because it explains why ransomware attacks have become so widespread.

Who Are the Threat Actors Behind Ransomware?

Ransomware isn’t random, it’s driven by organized groups with clear motivations. Security+ categorizes threat actors based on capability, resources, and intent.

1. Cybercriminal Organizations (organized crime)

These are the most common ransomware operators. They are:

• Highly organized
• Motivated by profit
• Skilled at evading detection
• Often operating internationally

Examples include groups that run RaaS platforms, recruit affiliates, and maintain customer‑service‑style portals for victims.

2. Nation‑State Actors

Some nation‑states use ransomware to:

• Disrupt critical infrastructure
• Generate revenue
• Conduct espionage under the guise of criminal activity

Security+ may frame these actors as APT groups (Advanced Persistent Threats).

3. RaaS Affiliates

Ransomware‑as‑a‑Service has created a marketplace where:

• Developers create ransomware
• Affiliates deploy it
• Profits are shared

This model dramatically increases the number of active attackers.

Why Ransomware Is So Effective

Why ransomware works:

• Organizations rely heavily on data availability
• Backups are often misconfigured or accessible to attackers
• Users fall for phishing
• Systems lack patching or hardening
• Attackers exploit remote access services
• Cryptocurrency enables anonymous payments

Ransomware succeeds because it targets the core of business operations.

Ransomware and Business Impact

Ransomware directly affects:

• Confidentiality – Data theft
• Integrity – Data corruption
• Availability – System downtime

Ransomware is a perfect example of why organizations need strong continuity planning.

How Organizations Defend Against Ransomware

Technical Controls

• Endpoint detection and response (EDR)
• Network segmentation
• Application whitelisting
• Patch management
• Disabling unnecessary remote services
• Immutable backups

Administrative Controls

• Security awareness training
• Phishing and smishing simulations
• Incident response planning
• Access control policies

Backup Strategies

• Offline backups
• Offsite backups
• Versioned backups
• Backup testing

Backups are the most reliable recovery method, if attackers can’t reach them.

Security+ Exam Traps to Avoid

Security+ loves to test ransomware with tricky wording. Watch for:

• “Files encrypted” → ransomware
• “Demand for payment” → ransomware
• “Double extortion” → data theft + encryption
• “Backups deleted” → lateral movement + privilege escalation
• “Cryptocurrency payment requested” → ransomware monetization

If encryption + extortion is present, the answer is almost always ransomware.

Sample Security+‑Style Question

An attacker gains access through a phishing email, encrypts the company’s file servers, and threatens to leak sensitive data unless paid in cryptocurrency. What type of attack is this?

Correct Answer: Ransomware (double extortion)

Ransomware is one of the most important topics in Security+. To master it, remember:

• It encrypts or locks data
• It uses extortion for payment
• Threat actors range from cybercriminals to nation‑states
• RaaS has expanded the ransomware ecosystem
• Defense requires layered controls and strong backups

Understanding ransomware isn’t just exam prep, it’s essential knowledge for any cybersecurity professional.