Ransomware
Malicious software that locks up or steals a business's files and demands payment to get them back.
Ransomware gangs break in, often through an unpatched flaw in a firewall, VPN, remote access tool or file transfer server. They spread through the network, copy data and then encrypt it.
Victims are asked to pay, usually in cryptocurrency, for a key to unlock their files and a promise not to publish what was stolen. Small businesses are frequent targets because they tend to patch slowly.
CISA flags flaws in its catalog that are known to be used in ransomware campaigns. Patch Sonar marks those with a red "Used by ransomware" tag and ranks them higher.
Why it matters to you: Filter Patch Sonar to "Used by ransomware" and make sure nothing on that list is in your stack. Good offline backups are the other half of the defence.
Related terms
- CISA's Known Exploited Vulnerabilities catalog (KEV)The U.S. government's official list of software flaws with confirmed real-world attacks, each with a deadline for federal agencies to fix it.
- Privilege escalationA flaw that lets someone who already has a little access, like a normal user account, take full control of a system.
- Authentication bypassA flaw that lets an attacker get past a login screen without a valid password.