Ransomware encrypts your files and demands payment for the decryption key. Attacks on Indian businesses have surged, targeting organisations of all sizes across every industry. The average cost of a ransomware incident — including downtime, recovery, and reputational damage — far exceeds the ransom demand itself.
How Ransomware Gets In
Phishing emails remain the primary delivery method. An employee opens a malicious attachment or clicks a link that downloads the ransomware payload. Exploiting vulnerabilities — unpatched servers, VPN appliances, and remote desktop services are common entry points. Compromised credentials from previous breaches give attackers direct access. Supply chain attacks deliver ransomware through trusted software updates or managed service providers.
Prevention Strategies
Patch management: Apply security patches within 48 hours of release for internet-facing systems. Automate patching where possible. Prioritise critical and high-severity vulnerabilities. Unpatched systems are the easiest entry point for ransomware operators.
Email security: Deploy email filtering that scans attachments in a sandbox environment. Block executable attachments. Train employees to recognise phishing. Implement DMARC, SPF, and DKIM to prevent email spoofing.
Endpoint protection: Deploy endpoint detection and response (EDR) on all devices. Modern EDR solutions detect ransomware behaviour — rapid file encryption, shadow copy deletion — and can stop an attack in progress.
Network segmentation: Divide your network into zones. If ransomware hits one segment, it cannot spread to others. Keep backups on a network segment that production systems cannot directly access.
Access controls: Enforce least privilege. Disable unnecessary admin accounts. Monitor for privilege escalation. Many ransomware attacks require admin access to maximise impact — limiting privileges limits damage.
Disable unnecessary services: If you do not need Remote Desktop Protocol (RDP) exposed to the internet, disable it. If you must use it, put it behind a VPN with MFA. RDP is the second most common ransomware entry point after phishing.
Backup Strategy: Your Last Line of Defence
Backups are the most important ransomware countermeasure. Follow the 3-2-1 rule: three copies of your data, on two different media types, with one copy stored offsite/offline. Ensure at least one backup copy is air-gapped or immutable — ransomware actively seeks and encrypts backups it can reach. Test restoration regularly. A backup you cannot restore is not a backup.
Detection and Response
Early detection limits damage. Monitor for: unusual file encryption activity, mass file renaming, shadow copy deletion commands, abnormal network traffic (C2 communication), and user accounts accessing resources they normally do not. Alerts on these indicators can catch an attack within minutes of launch, before it encrypts your entire environment.
If You Are Hit
Isolate immediately. Disconnect affected systems from the network to prevent spread. Do not shut them down — volatile memory may contain decryption keys or forensic evidence.
Assess the scope. Determine which systems are affected, what data is encrypted, and whether backups are intact.
Engage experts. Contact your incident response team or a professional cybersecurity firm. Report the incident to CERT-In (Indian Computer Emergency Response Team) as required by regulation.
Do not pay the ransom. Payment does not guarantee data recovery — many victims who pay never receive a working decryption key. Payment funds criminal operations and marks your organisation as willing to pay, inviting future attacks.
Recover from backups. Rebuild affected systems from clean images. Restore data from verified backups. Patch the vulnerability that was exploited before bringing systems back online.
Post-Incident
Conduct a thorough post-incident review. How did the attacker get in? What controls failed? What worked? Update your defences, detection rules, and incident response plan based on lessons learned. Communicate transparently with affected stakeholders — customers, employees, partners — about what happened and what you have done to prevent recurrence.
