Key takeaway
Do not classify an incident from the ransom note alone. Work with the response team to establish which data was encrypted or stolen, whether accounts and systems were affected, and whether the threat includes publication, pressure on third parties or service disruption.
Core types and overlapping categories
Ransomware commonly makes files unavailable through encryption or locks access to a device. Some incidents add data theft as a separate source of pressure. These categories can overlap: “mobile” describes the target platform, while a service model describes how criminals divide the work.
File encryptors
A file encryptor may encrypt files on a device and reachable network shares, then demand payment for decryption or restored access. Symmetric and asymmetric cryptography may be combined; this is not simply a password lock.
Device and screen lockers
A locker may deny screen, account or device access and demand payment. Files are not necessarily encrypted. Distinguish extortionate locking from an ordinary account lockout and determine what access was denied.
Doxware and leakware
In leakware or doxware, criminals may threaten to publish or share stolen sensitive data. Even without encryption, this can require a separate investigation, breach assessment and review of applicable notification procedures.
Mobile ransomware
Mobile ransomware may restrict data or account access or lock a screen. Capabilities vary by mobile OS and app permissions; do not assume the same behavior on every phone. Plan separate recovery for accounts, authentication apps and work data.
Family, delivery, business model and impact
“Fileless,” “mobile” and “RaaS” refer to different classification levels. A precise description separately identifies the software involved, how access was gained, how criminals worked together and which threat they used to pressure the victim.
Delivery and execution path
Access may come through phishing, a malicious site or download, stolen credentials, exposed RDP or an exploitable vulnerability. Exposed RDP is an access risk, not automatically an exploitable flaw. Legitimate tools such as PowerShell can run malicious code in memory but can also launch file-based payloads; PowerShell use alone does not make an attack fileless.
Ransomware-as-a-Service (RaaS)
RaaS is a criminal service model: malware and infrastructure providers can be separate from affiliates or partners conducting attacks, with roles and proceeds divided by agreement. It is not a file type or technical attack method.
Encryption or data theft
Encryption disrupts access to files and systems. Theft with a disclosure threat can also occur without encryption; do not automatically label it a file-encrypting ransomware attack. Record the confirmed mechanism and data movement separately rather than relying only on the demand text.
A typical attack sequence
Incidents do not all follow the same sequence. After initial access, an attacker may inspect accounts, network connections and files, steal data, target systems and backups, then encrypt or threaten the victim. Records from these stages help reconstruct a timeline and determine scope.
Initial access
A phishing link or attachment, malicious site, stolen credential, exposed service or another access route may be involved. Separately check that RDP is secured under the organization’s remote-access policy.
Discovery and account compromise
After access, criminals may inspect users, devices, shared folders, network connections and security tools. Correlate suspicious accounts and processes with events on other devices.
File discovery and data exfiltration
An attacker may search important folders and network resources, then archive and transfer data out of the system. Encryption may not occur at this stage; security, legal and privacy teams should assess data protection and notification needs together.
Encryption, locking and demand
Files may be encrypted, a screen or device locked, and a ransom note left behind. If the demand also threatens publication of stolen data, notification of partners or service disruption, track each form of pressure in the response plan.
What do double and triple extortion mean?
Double extortion combines encryption with data theft and a threat to expose the stolen information. Triple extortion is used for some cases that add pressure on partners, customers or other third parties, or threats to disrupt a service. Usage varies, so incident records should state the specific threats observed.
First form of pressure: loss of access
Encrypted files or a locked device can interrupt work. Follow the organization’s incident plan to isolate affected systems and establish scope.
Second form of pressure: data exposure
A threat to publish stolen data can require a separate privacy and legal assessment regardless of encryption. The organization’s responsible teams should determine applicable notifications.
Additional pressure: third parties and services
Threats to contact partners or customers or disrupt a service can add pressure. The threat alone does not prove data theft. Review third-party communications and service-continuity plans and record the observed threats separately.
Frequently asked questions
Investigating the attack mechanism, access path and threats separately helps teams plan a response.
Is scareware ransomware?
Scareware uses fake warnings to prompt payment, installation or remote access. A fake warning alone does not prove ransomware; an associated payload may encrypt files or lock a device, changing the classification.
Can an incident involve ransomware without encryption?
Yes. Locker ransomware can demand payment for device access without encrypting files. Theft-only extortion can also occur without encryption but is not automatically a ransomware attack. Record access locking, encryption and data theft separately.
Does cryptocurrency make an attacker untraceable?
No. A payment method does not prove an attacker’s identity or location, nor does it make tracing impossible. Legal, security and leadership teams should make payment decisions under the organization’s plan and applicable advice.
Are file encryption and device locking the same?
No. Encryption can make a file unreadable without a key; a locker blocks a screen, account or device access. Identify what was affected because recovery options can differ.