Ransomware: why backups beat paying

Ransomware is malicious software that takes something you value hostage and demands payment to give it back. Classic ransomware encrypts files, turning family photos, client documents or a company’s entire file server into unreadable data, then shows a note explaining how to pay, usually in cryptocurrency, to receive the decryption key. MITRE ATT&CK files this behaviour under “data encrypted for impact”: the encryption is not there to protect anything, only to deny you access.

How an attack unfolds

Ransomware rarely appears out of nowhere. The US Cybersecurity and Infrastructure Security Agency (CISA) describes the common entry points in its #StopRansomware guide: phishing emails, stolen or weak passwords for remote access, and unpatched vulnerabilities in internet-facing systems. On a personal computer, a trojan or a malicious download is the usual first step. Once inside, attackers frequently spend time looking around, disabling backups they can reach and copying valuable data, before triggering the encryption that the victim finally notices.

Double extortion: steal first, then lock

Backups made ransomware less profitable, so criminal groups adapted. Many now copy data away before encrypting it, then threaten to publish it if the victim refuses to pay. CISA calls this double extortion. It changes the calculation for businesses and individuals alike: a good backup gets your files back, but it does not undo a leak. That is why the outbound part of an attack matters as much as the encryption, and why seeing large or unusual uploads from a machine is a meaningful warning sign.

Why paying is a gamble

CISA and the FBI advise against paying ransoms. Payment does not guarantee a working decryption key, the tools criminals provide are sometimes slow or broken, and a copy of stolen data may still be sold or published later. Paying also funds the next attack and marks the victim as someone willing to pay. There can be legal risks too, depending on who receives the money. Before considering anything else, check the No More Ransom project, a collaboration between law enforcement and security companies that publishes free decryption tools for ransomware families whose encryption has been broken.

The 3-2-1 backup rule

Nothing weakens ransomware like a backup the attacker cannot reach. The long-standing 3-2-1 rule, recommended in CISA’s guidance on backups, is simple to remember:

• 3 copies of your important data: the original and two backups.
• 2 different kinds of storage, for example an external drive and a cloud service.
• 1 copy kept offline or off-site, disconnected from the computer, so ransomware on the Mac cannot encrypt it too.

On a Mac, Time Machine to an external drive covers the first part well; unplugging that drive when the backup is done keeps it out of reach. A second copy in a cloud service that keeps previous versions of files helps if the synced copy is overwritten with encrypted files. And a backup is only real once you have tested restoring from it: pick a file every few months and bring it back.

What FileVault and cloud sync do, and do not, do

Two Mac features are often mistaken for ransomware protection. FileVault encrypts your disk so that a thief who steals the Mac cannot read it; it does nothing against ransomware running inside your logged-in account, which sees your files decrypted just like you do. Cloud sync services such as iCloud Drive keep your files the same everywhere, which means an encrypted file can be synced over the good copy on your other devices. Sync is not a backup. What helps is version history, where the service keeps earlier versions of each file for a while, and a real backup that sync cannot touch.

Reducing the chance of an attack

• Keep macOS and apps up to date; many ransomware intrusions start with a known, already patched flaw.
• Use unique passwords and two-factor authentication, especially for remote access and email.
• Be suspicious of attachments and links, even from people you know.
• Do not install cracked software or unverified tools.
• Turn off sharing services you do not use, such as File Sharing and Remote Login.

Where a firewall helps

A firewall cannot decrypt files and FireAI does not remove ransomware. What it can do is limit the steps around the encryption. Ransomware and the tools that deliver it usually need to download components and contact their operators, and double extortion needs to upload your data. FireAI asks before an unknown app connects, shows where each app sends data on the world map, and its Paranoid and Under attack modes restrict what can connect at all. If you suspect an active attack, the kill switch cuts the Mac off from the internet in one click while you disconnect backups and get help.

If it happens

• Disconnect the computer from the network and unplug any backup drives.
• Do not delete the ransom note; take a photo of it. It helps identify the ransomware family.
• Check No More Ransom for a free decryptor.
• Report it: in the US to the FBI’s Internet Crime Complaint Center (IC3), elsewhere to your national cybercrime authority.
• Restore from a clean, offline backup onto a freshly reinstalled system.
• Change passwords from a clean device, especially if data may have been stolen.