Ransomware & Destructive Malware for Executives

Reading time ~13 minutes · No technical prerequisites · Day 3, Module 3.3

Ransomware is the crisis that tests every foundation at once — identity, backups, segmentation, communications, and leadership under pressure. Its defining feature for an executive is that the decisive moves are made before the incident: resilience funded, decisions pre-made, and the plan rehearsed. By the time you see the ransom note, most of your options were determined weeks earlier.

A criminal economy

Modern ransomware is an industry, not a lone hacker. Ransomware-as-a-service rents tooling to affiliates; initial-access brokers specialise in selling the way in; and extortion has escalated from simple encryption to double extortion (encrypt and steal, then threaten to leak) and even triple extortion (add pressure by harassing your customers, partners, or the press). The professionalisation of every step is why both the volume and the sophistication of attacks keep climbing — and why backups alone, while essential, no longer neutralise the threat of a damaging leak.

The kill-chain and the cheapest intervention

Encryption is the last step of a long intrusion, not the first. A typical chain runs from initial access — a phishing lure, a valid stolen account, an exposed service — through foothold and privilege escalation, lateral movement, and data exfiltration, before the visible mass encryption event. By the time encryption appears, the attacker has usually been inside for days or weeks. The cheapest place to stop the whole chain is therefore the very first step, which is exactly where the personal and organisational fundamentals from Lessons 1 and 4 — phishing-resistant authentication, least privilege, prompt patching — do their work.

Resilience is the real defence

Because prevention is never perfect, recovery capability is the true defence. That means offline or immutable backups following the 3-2-1 rule — multiple copies the attacker cannot reach or alter, since capable adversaries target backups first. It means tested restoration, because a backup you have never restored is a hope, not a plan. It means segmentation to limit the blast radius so a single foothold is not the whole estate. And it means incident-response readiness — roles, communications, and decision authority arranged in advance. Every one of these costs money and attention before any incident occurs, which makes funding resilience a decision only the leader can make, and only ahead of time.

The decision to pay

Whether to pay a ransom is genuinely hard. Against paying: it funds and encourages the crime, may be sanctioned or unlawful, offers no guarantee of recovery, and does not un-leak stolen data. In reality it is sometimes framed as the only route to continuity, and the legal, ethical, and safety dimensions collide. The essential discipline is that this must be a pre-decided policy, informed by legal and sanctions advice and by your actual backup posture — never a panic call made under duress, which is precisely the condition the attacker engineers.

What determines a sound response is not the ransom amount or the attacker's promises, but the policy, backups, and legal position you settled in advance.

The first hour

When an incident breaks, the leader's job is to direct, not to do. The priorities are to contain — isolate affected systems to slow the spread; preserve — avoid destroying evidence you will later need; convene the pre-named crisis team with clear authority; and communicate with legal, regulators, and stakeholders according to the plan rather than by instinct. Several of these pull against each other — containment versus evidence preservation, transparency versus discretion — and those tensions are exactly why organisations rehearse. The Day 3 capstone tabletop turns them from theory into a lived decision.