Ransomware is a type of malicious software that blocks access to your computer or files until you pay a sum of money. Think of it like digital kidnapping. The software finds your important files—photos, documents, videos—and scrambles them using strong encryption, making them completely unreadable.

Once your files are locked, a message appears on your screen. This is the ransom note. It explains what has happened and gives you instructions on how to pay, almost always in cryptocurrency like Bitcoin, to get the decryption key. The attackers promise that this key will unlock your files.

Ransomware isn't new. The first documented case was the AIDS Trojan back in 1989. It was sent to researchers on floppy disks. After a certain number of reboots, the malware would encrypt file names on the computer and demand the user mail $189 to a PO Box in Panama.

By today's standards, it was primitive. The encryption was weak and easily reversible. But it set the stage for what was to come.

Modern ransomware emerged with two game-changing technologies: powerful public-key encryption and anonymous cryptocurrencies. Strong encryption makes it nearly impossible to break the lock on the files without the attacker's key. Cryptocurrencies allow attackers to receive payments without revealing their identity, making the crime much harder to trace.

Though there are many variants, most ransomware attacks follow a similar pattern. The process can be broken down into a few general stages.

1. Infection: First, the ransomware must get onto a device. This can happen in many ways, but the initial entry is the critical first step.
2. Encryption: Once on the system, the ransomware quietly begins its main task. It scans the computer for valuable files—like .jpg, .docx, or .pdf files—and encrypts them. This process scrambles the data into an unreadable format. The original, unencrypted files are often deleted to prevent easy recovery.
3. Ransom Demand: After the encryption is complete, the ransomware reveals itself. It displays a ransom note on the screen and may even change the user's desktop wallpaper to the message. The note typically includes the ransom amount, the payment deadline, and instructions for buying cryptocurrency and sending it to the attacker's digital wallet.
4. Outcome: The victim is left with a choice: pay the ransom or lose the files. If the ransom is paid, the attackers may provide the decryption key, though there's no guarantee. If it's not paid, the files usually remain encrypted forever.

Understanding this basic lifecycle is the first step toward recognizing and defending against this threat.