What type of malware encrypts files and demands a ransom?

What type of malware encrypts files and demands a ransom? Ransomware is malware that blocks access to data—often by encrypting files—and demands payment for their supposed recovery.

Early ransomware appeared in 1989 as the AIDS Trojan, which hid file names and demanded payment. Modern campaigns commonly arrive through phishing emails, malicious downloads, stolen credentials, or vulnerabilities. Some attacks also steal data before encryption, creating an additional threat of public release.

Ransomware is sometimes confused with a Trojan, but a Trojan describes how malware disguises itself; ransomware describes its extortion purpose. WannaCry, which spread rapidly in 2017, showed that ransomware can also behave like a worm by moving automatically between vulnerable computers.

Paying does not guarantee decryption, and strong defenses include offline backups, timely patching, multifactor authentication, and cautious handling of attachments. Some victims recover files through backups or recovered keys, but prevention and incident response remain essential.