---
title: "Ransomware: How cyber attackers turn hacking into profit"
description: Learn about the growing cyber threat that attackers use to make money… by taking yours.
image: https://blog.teamascend.com/hubfs/Blog%20Feature%20Images/110619_CyberattackSeries-06.jpg
---
[Skip to main content](https://blog.teamascend.com/blog/ransomware#main)
[ ](https://teamascend.com/)
- [Show submenu for Services Services](http://teamascend.com/services/)
- [Show submenu for IT Consulting IT Consulting](https://teamascend.com/services/strategic-consulting/)
- [Healthcare Consulting](https://teamascend.com/services/healthcare/)
- [Show submenu for Cybersecurity Cybersecurity](https://teamascend.com/services/cybersecurity/)
- [Ascend Defend | Microsoft Security](https://teamascend.com/services/microsoft-365/microsoft-security-ascend-defend/)
- [Managed Detection & Response](https://teamascend.com/services/cybersecurity/managed-detection-response/)
- [Identity Protection & MFA](https://teamascend.com/services/cybersecurity/identity-protection-mfa/)
- [Email Security](https://teamascend.com/services/cybersecurity/email-security/)
- [Perimeter Security](https://teamascend.com/services/cybersecurity/perimeter-security-ngfw/)
- [vCISO](https://teamascend.com/services/cybersecurity/vciso/)
- [Security Risk Assessment](https://teamascend.com/services/it-assessments/security-risk-assessment/)
- [Penetration Testing](https://teamascend.com/services/infrastructure/penetration-testing/)
- [Vulnerability Management](https://teamascend.com/services/cybersecurity/vulnerability-management-program/)
- [Security Awareness Training](https://teamascend.com/services/cybersecurity/security-awareness-program/)
- [Show submenu for IT Infrastructure IT Infrastructure](https://teamascend.com/services/infrastructure/)
- [24/7 Support Desk](https://teamascend.com/services/infrastructure/support-desk/)
- [VCIO](https://teamascend.com/services/infrastructure/vcio/)
- [Managed Infrastructure](https://teamascend.com/services/infrastructure/managed-infrastructure-services/)
- [Data Protection (BaaS)](https://teamascend.com/services/infrastructure/data-protection/)
- [Onsite Rounding](https://teamascend.com/services/infrastructure/onsite-rounding/)
- [Application Administration Services](https://teamascend.com/services/infrastructure/application-administration/)
- [IT Infrastructure Assessment](https://teamascend.com/services/it-assessments/infrastructure-assessment/)
- [Product](https://teamascend.com/services/infrastructure/product/)
- [Show submenu for Cloud Cloud](https://teamascend.com/services/cloud-computing/)
- [Ascend Cloud | Managed Private Data Center](https://teamascend.com/services/cloud-computing/edafio-cloud/)
- [Hybrid Cloud](https://teamascend.com/services/cloud-computing/hybrid-cloud-solutions/)
- [Cloud Security (CSPM)](https://teamascend.com/services/cloud-computing/cloud-security-posture-management/)
- [Cloud Assessment](https://teamascend.com/services/cloud-computing/cloud-assessment/)
- [Digitial Workspace Deployment](https://teamascend.com/services/cloud-computing/digital-workspace-deployment/)
- [Cloud Migration](https://teamascend.com/services/cloud-computing/cloud-migration/)
- [Show submenu for Microsoft Services Microsoft Services](https://teamascend.com/services/microsoft-365/)
- [Ascend Defend | Microsoft Security](https://teamascend.com/services/microsoft-365/microsoft-security-ascend-defend/)
- [Microsoft 365 Copilot](https://teamascend.com/services/microsoft-365/microsoft-365-copilot/)
- [Microsoft Licensing](https://teamascend.com/services/microsoft-365/microsoft-licensing/)
- [Microsoft 365 Management](https://teamascend.com/services/microsoft-365/microsoft-365-management/)
- [Microsoft 365 Migration](https://teamascend.com/services/microsoft-365/)
- [Show submenu for Salesforce Salesforce](https://teamascend.com/salesforce-services/)
- [Consulting Services](https://teamascend.com/salesforce-services/salesforce-consulting-services/)
- [Implementation Services](https://teamascend.com/salesforce-services/salesforce-implementation-services/)
- [Managed Services](https://teamascend.com/salesforce-services/salesforce-managed-services/)
- [Embedded Experts](https://teamascend.com/salesforce-services/salesforce-embedded-experts/)
- [Optimization Assessment](https://teamascend.com/salesforce-services/salesforce-optimization-assessment/)
- [Salesforce AppExchange](https://teamascend.com/salesforce-services/salesforce-appexchange/)
- [HubSpot Services](https://teamascend.com/services/hubspot-services/)
- [App Development](https://teamascend.com/services/application-development/)
- [Show submenu for Industries Industries](https://teamascend.com/industries/)
- [Financial Services](https://teamascend.com/industries/financial-services/)
- [Private Equity](https://teamascend.com/industries/private-equity/)
- [Insurance](https://teamascend.com/industries/insurance/)
- [Manufacturing](https://teamascend.com/industries/manufacturing/)
- [Healthcare](https://teamascend.com/industries/healthcare/)
- [Legal](https://teamascend.com/industries/legal/)
- [Accounting](https://teamascend.com/industries/accounting/)
- [Show submenu for Resources Resources](https://teamascend.com/resources/)
- [Client Success Stories](https://teamascend.com/client-success-stories/)
- [Events](https://teamascend.com/events/)
- [Solutions-Focused PDFs](https://teamascend.com/resources/#solutions)
- [Blog](https://blog.teamascend.com/)
- [Webinars](https://teamascend.com/resources/?_resource_type=webinar)
- [All Resources](https://teamascend.com/resources/)
- Show submenu for Company Company
- [About Ascend Technologies](https://teamascend.com/about/)
- [Leadership Team](https://teamascend.com/about/team/)
- [Partners With Us](https://teamascend.com/about/partner-with-us/)
- [Awards & Recognitions](https://teamascend.com/about/awards/)
- [Certifications](https://teamascend.com/about/certifications/)
- [Careers](https://teamascend.com/careers/)
- [Internships](https://teamascend.com/careers/internships/)
- [Connect](https://teamascend.com/contact/)
Open main navigation
Close main navigation
- Show submenu for Services Services
- Services
- [Services](http://teamascend.com/services/)
- Show submenu for IT Consulting IT Consulting
- IT Consulting
- [IT Consulting](https://teamascend.com/services/strategic-consulting/)
- [Healthcare Consulting](https://teamascend.com/services/healthcare/)
- Show submenu for Cybersecurity Cybersecurity
- Cybersecurity
- [Cybersecurity](https://teamascend.com/services/cybersecurity/)
- [Ascend Defend | Microsoft Security](https://teamascend.com/services/microsoft-365/microsoft-security-ascend-defend/)
- [Managed Detection & Response](https://teamascend.com/services/cybersecurity/managed-detection-response/)
- [Identity Protection & MFA](https://teamascend.com/services/cybersecurity/identity-protection-mfa/)
- [Email Security](https://teamascend.com/services/cybersecurity/email-security/)
- [Perimeter Security](https://teamascend.com/services/cybersecurity/perimeter-security-ngfw/)
- [vCISO](https://teamascend.com/services/cybersecurity/vciso/)
- [Security Risk Assessment](https://teamascend.com/services/it-assessments/security-risk-assessment/)
- [Penetration Testing](https://teamascend.com/services/infrastructure/penetration-testing/)
- [Vulnerability Management](https://teamascend.com/services/cybersecurity/vulnerability-management-program/)
- [Security Awareness Training](https://teamascend.com/services/cybersecurity/security-awareness-program/)
- Show submenu for IT Infrastructure IT Infrastructure
- IT Infrastructure
- [IT Infrastructure](https://teamascend.com/services/infrastructure/)
- [24/7 Support Desk](https://teamascend.com/services/infrastructure/support-desk/)
- [VCIO](https://teamascend.com/services/infrastructure/vcio/)
- [Managed Infrastructure](https://teamascend.com/services/infrastructure/managed-infrastructure-services/)
- [Data Protection (BaaS)](https://teamascend.com/services/infrastructure/data-protection/)
- [Onsite Rounding](https://teamascend.com/services/infrastructure/onsite-rounding/)
- [Application Administration Services](https://teamascend.com/services/infrastructure/application-administration/)
- [IT Infrastructure Assessment](https://teamascend.com/services/it-assessments/infrastructure-assessment/)
- [Product](https://teamascend.com/services/infrastructure/product/)
- Show submenu for Cloud Cloud
- Cloud
- [Cloud](https://teamascend.com/services/cloud-computing/)
- [Ascend Cloud | Managed Private Data Center](https://teamascend.com/services/cloud-computing/edafio-cloud/)
- [Hybrid Cloud](https://teamascend.com/services/cloud-computing/hybrid-cloud-solutions/)
- [Cloud Security (CSPM)](https://teamascend.com/services/cloud-computing/cloud-security-posture-management/)
- [Cloud Assessment](https://teamascend.com/services/cloud-computing/cloud-assessment/)
- [Digitial Workspace Deployment](https://teamascend.com/services/cloud-computing/digital-workspace-deployment/)
- [Cloud Migration](https://teamascend.com/services/cloud-computing/cloud-migration/)
- Show submenu for Microsoft Services Microsoft Services
- Microsoft Services
- [Microsoft Services](https://teamascend.com/services/microsoft-365/)
- [Ascend Defend | Microsoft Security](https://teamascend.com/services/microsoft-365/microsoft-security-ascend-defend/)
- [Microsoft 365 Copilot](https://teamascend.com/services/microsoft-365/microsoft-365-copilot/)
- [Microsoft Licensing](https://teamascend.com/services/microsoft-365/microsoft-licensing/)
- [Microsoft 365 Management](https://teamascend.com/services/microsoft-365/microsoft-365-management/)
- [Microsoft 365 Migration](https://teamascend.com/services/microsoft-365/)
- Show submenu for Salesforce Salesforce
- Salesforce
- [Salesforce](https://teamascend.com/salesforce-services/)
- [Consulting Services](https://teamascend.com/salesforce-services/salesforce-consulting-services/)
- [Implementation Services](https://teamascend.com/salesforce-services/salesforce-implementation-services/)
- [Managed Services](https://teamascend.com/salesforce-services/salesforce-managed-services/)
- [Embedded Experts](https://teamascend.com/salesforce-services/salesforce-embedded-experts/)
- [Optimization Assessment](https://teamascend.com/salesforce-services/salesforce-optimization-assessment/)
- [Salesforce AppExchange](https://teamascend.com/salesforce-services/salesforce-appexchange/)
- [HubSpot Services](https://teamascend.com/services/hubspot-services/)
- [App Development](https://teamascend.com/services/application-development/)
- Show submenu for Industries Industries
- Industries
- [Industries](https://teamascend.com/industries/)
- [Financial Services](https://teamascend.com/industries/financial-services/)
- [Private Equity](https://teamascend.com/industries/private-equity/)
- [Insurance](https://teamascend.com/industries/insurance/)
- [Manufacturing](https://teamascend.com/industries/manufacturing/)
- [Healthcare](https://teamascend.com/industries/healthcare/)
- [Legal](https://teamascend.com/industries/legal/)
- [Accounting](https://teamascend.com/industries/accounting/)
- Show submenu for Resources Resources
- Resources
- [Resources](https://teamascend.com/resources/)
- [Client Success Stories](https://teamascend.com/client-success-stories/)
- [Events](https://teamascend.com/events/)
- [Solutions-Focused PDFs](https://teamascend.com/resources/#solutions)
- [Blog](https://blog.teamascend.com/)
- [Webinars](https://teamascend.com/resources/?_resource_type=webinar)
- [All Resources](https://teamascend.com/resources/)
- Show submenu for Company Company
- Company
- [About Ascend Technologies](https://teamascend.com/about/)
- [Leadership Team](https://teamascend.com/about/team/)
- [Partners With Us](https://teamascend.com/about/partner-with-us/)
- [Awards & Recognitions](https://teamascend.com/about/awards/)
- [Certifications](https://teamascend.com/about/certifications/)
- [Careers](https://teamascend.com/careers/)
- [Internships](https://teamascend.com/careers/internships/)
- [Connect](https://teamascend.com/contact/)
- [24/7 Client Services](https://portal-ascend.okta.com/)
[24/7 Client Services](https://portal-ascend.okta.com/)
Ransomware, Endpoint Detection & Response (EDR)
# Ransomware: How cyber attackers turn hacking into profit
TEAM ASCEND
November 5, 2019
- [.svg)](https://www.linkedin.com/sharing/share-offsite/?url=https%3A%2F%2Fblog.teamascend.com%2Fblog%2Fransomware)
- [.svg)](https://www.facebook.com/sharer/sharer.php?u=https%3A%2F%2Fblog.teamascend.com%2Fblog%2Fransomware)
- [](mailto:?subject=%3Cspan+id%3D%22hs_cos_wrapper_name%22+class%3D%22hs_cos_wrapper+hs_cos_wrapper_meta_field+hs_cos_wrapper_type_text%22+style%3D%22%22+data-hs-cos-general-type%3D%22meta_field%22+data-hs-cos-type%3D%22text%22+%3ERansomware%3A+How+cyber+attackers+turn+hacking+into+profit%3C%2Fspan%3E&body=https%3A%2F%2Fblog.teamascend.com%2Fblog%2Fransomware)
### *Learn about the growing cyber threat that attackers use to make money… by taking yours.*
Once an attacker has their target and has gained access, or “gotten in,” there are multiple ways they can “profit” from the cyberattack:
- ***Siphoning or exfiltrating valuable data from the victim***
Organizations all hold valuable data, even small businesses that may think they have nothing an attacker would want to steal. Financial information, customer data, health records, and even proprietary business records are of value to an attacker for either furthering the impact of an attack or for sale on the dark web. There is not a single industry or type of organization that is considered “safe” from cyber risk—all organizations of every size hold some level of valuable resources that attackers are always after.
- ***Transferring actual funds***
If an attacker can easily get access to financial records, accounts, or otherwise obtain actual funds to reach their goal, your organization’s money will be at risk.
- ***Demanding a ransom***
This method is back on the rise after [doubling in frequency in 2019](https://healthitsecurity.com/news/ransomware-attacks-double-in-2019-brute-force-attempts-increase). Attackers can use system or network access to deploy a malicious program that locks down an organization’s files to hold them for ransom. Attackers appear to favor this method because it’s a fairly simple attack tactic that allows them to get paid quickly, and directly from their victim.
## **How does ransomware work?**
The concept of ransomware, as [one traditional AV provider put it](https://us.norton.com/internetsecurity-malware-ransomware-5-dos-and-donts.html), is actually one of the more simple cyber attack concepts in today’s threat landscape:
> *“Lock and encrypt a victim’s computer data, then demand a ransom to restore access.”*
>
>
It should be no surprise that a cyberattack with such a simple explanation is also fairly simple for attackers to carry out.
As explained in the [Cyberattack Series](https://blog.teamascend.com/topic/cyberattack-series), after an attacker has chosen their target and gathered information about that target, they have a variety of options and possible next-steps to compromise their victim. In terms of ransomware attacks, because the [payload](https://www.trendmicro.com/vinfo/us/security/definition/payload) comes in the form of a simple piece of malicious software, cyber attackers can choose almost any method to carry out the attack:
- Malicious attachment in a phishing email
- Drive-by-downloaders on compromised websites
- Placing the file directly on the user’s system (possible only if the attacker has gained access to the system using other methods, like exploiting an unpatched vulnerability)
No matter how the attacker chooses to deliver the payload, the following progression is always quick and easy.
First, if the ransomware file is allowed to execute (i.e. it gets onto the user’s system and is not blocked), it will immediately begin encrypting the files on the system.
Next, it will display a message to the user informing them that their files have been encrypted, usually paired with a message demanding a hefty ransom payment in return for their files to be unlocked. Different attackers will use different styles of ransom message screens and phrasing, but whether it’s a fake government-themed page or a big red screen, it is meant to get the user’s attention and inspire urgent action.
Attackers will use ransomware to obtain payment in the form of a [cryptocurrency](https://www.theguardian.com/technology/2017/may/15/digital-gold-why-hackers-love-bitcoin-ransomware), like Bitcoin, because the currency provides a level of anonymity that makes the exchange virtually untraceable back to the attacker. That’s great news for bad guys and not-so-great news for their victims: if the attacker can’t be traced, they can’t be caught.
The final step and end-goal for ransomware attacks, therefore, is to receive the ransom payment (usually via cryptocurrency) and move on to their next target.
## **Ransomware in action**
In the short video below, watch as Security Engineer Will explains how easily a ransomware attack can be executed, and walks through a few methods to prevent and detect this type of attack in your organization.
## **Cybersecurity Game Plan**
###### *Offense*
When an organization is hit with a ransomware attack, the first question is whether or not to pay the ransom to the attacker. What do you do?
It’s important to note that while an organization with a robust backup system in place is able to bypass the ransom and simply restore the computer or system that was compromised, the ransomware issue is still far from resolved. A case of ransomware can range from a “one-and-done” malware drop to a
- *How long did the attacker have access?*
- *How did the attacker deploy the attack?*
- *Did they bring other malware into the environment along with the ransomware?*
These are the vital questions to ask after a ransomware attack—not just, “How can we get our data back?” Whether a ransom is paid, or a system is restored from a backup, those steps don’t provide any insight into whether the attack is *actually* over.
This is why detection, investigation, and incident response are vital offensive measures after being hit by an attack.
An [Endpoint Detection & Response (EDR) solution](https://content.infogressive.com/complete-guide-to-edr) is key in these stages, as it allows security experts to review the activity taken on an endpoint, like the laptop or desktop that gets hit by ransomware, and trace the full path of the attack. Expert security investigation is faster, easier, and cheaper when endpoint data is actively collected and correlated as the attack takes place.
Whether EDR is present on the system or not, post-breach investigation is [always necessary](https://content.infogressive.com/ir-case-study-healthcare) to ensure that the attacker behind the ransomware is locked out, security is restored, and a plan is created to prevent the attack from happening again.
*[](https://cta-redirect.hubspot.com/cta/redirect/2733374/dc830767-cc32-4099-9da8-4c946a1b023c)*
###### *Defense*
Why wait until you’ve been hit with ransomware to start taking action? Defending your organization’s security is possible—*prevention* is possible—with the combination of malware prevention[ an advanced endpoint antivirus](https://content.teamascend.com/dont-get-popped-by-ransomware) and security experts to back it up.
Traditional anti-virus (AV) solutions are [struggling to keep up](https://slate.com/technology/2017/02/why-you-cant-depend-on-antivirus-software-anymore.html) with new and advanced malware-based attacks. Relying on a database of malware and malware identifiers is what sets traditional AV behind—the programs simply can’t stop an attack that is new or unique, because they have no reference to identify an unknown piece of malware. A database for malware is a good first step, but the bad guys caught on to that a long time ago…
Today, they just make new variations of malware—called Zero-Day Malware—and easily bypass traditional AV solutions to hit their targets.
Next-generation [Malware Prevention](https://www.infogressive.com/managed-security/endpoint-security/malware-prevention/)uses advanced techniques to analyze and identify malware of all kinds, so it doesn’t rely on a “repeat offenders” list of known malware to operate. This type of malware prevention is 99% effective, versus the[40-70% efficacy](https://securityintelligence.com/news/is-antivirus-protection-still-relevant/) of traditional solutions. When paired with a 24x7 [Security Operations Center (SOC)](https://www.infogressive.com/managed-security/soc-as-a-service/) that actively monitors endpoint activity and AV alarms, it’s guaranteed that your organization will not suffer the consequences of a ransomware attack.
But what if you could stop the ransomware attack before the malicious file even makes it onto the computer?
In the case of email-delivered ransomware attacks, this is entirely possible with the combination of a robust [email security](https://www.infogressive.com/managed-security/email-security/) solution and security-aware users.
Your email client, like Office 365 or Google’s GSuite, may have some basic security features built-in to [monitor for spam emails or warn you about suspicious email content](https://www.techrepublic.com/article/why-g-suite-admins-should-enable-gmails-advanced-anti-phishing-and-malware-settings/), but carefully-crafted phishing emails can, [and do,](https://threatpost.com/energy-phish-microsoft-security-google-drive/147397/) make it through to unsuspecting inboxes every day. Organizations can reduce the number of phishing emails they receive by adding a layer of security to their email platform that scans for malicious email content, confirms it through the use of [sandboxing](https://www.youtube.com/watch?v=Bx3fkt_GKDs), and retains malicious emails in a quarantine environment—keeping attacks out of users’ inboxes.
And if email security doesn’t do the trick? Training users to [identify and avoid phishing emails](https://blog.teamascend.com/7-signs-of-a-phishing-email), or other signs of an attack, is another key security layer that helps keep malware from getting onto your organization’s computers.
[](https://cta-redirect.hubspot.com/cta/redirect/2733374/d534b9a3-49dd-43ed-bea1-15a16ab3565e)
### Table of Contents
#### Get Insights Sent to Your Inbox
## Related Articles
Ransomware, Endpoint Detection & Response (EDR)
### [How to Build an AI Governance Framework a Lean IT Team Can Run](https://blog.teamascend.com/blog/ai-governance-framework-for-lean-it-teams-ascend)
September 24, 2026
[Read Now .svg)](https://blog.teamascend.com/blog/ai-governance-framework-for-lean-it-teams-ascend)
Ransomware, Endpoint Detection & Response (EDR)
### [How to Choose the Right Salesforce Products for Your Business](https://blog.teamascend.com/blog/how-to-choose-the-right-salesforce-products-for-your-business)
September 22, 2026
[Read Now .svg)](https://blog.teamascend.com/blog/how-to-choose-the-right-salesforce-products-for-your-business)
Ransomware, Endpoint Detection & Response (EDR)
### [What Is Shadow AI, and Why Is It a Compliance Risk Right Now?](https://blog.teamascend.com/blog/shadow-ai-compliance-risk-regulated-industries)
September 17, 2026
[Read Now .svg)](https://blog.teamascend.com/blog/shadow-ai-compliance-risk-regulated-industries)
[](https://teamascend.com/)
Contact
833-639-2285
-
-
-
-
-
- Company
- [About](https://teamascend.com/about/)
- [Services](https://teamascend.com/services/)
- [Testimonials](https://teamascend.com/client-success-stories/)
- [Partner With Us](https://teamascend.com/about/partner-with-us/)
- [Resources](https://teamascend.com/resources/)
- [Contact](https://teamascend.com/contact/)
- [Careers](https://teamascend.com/careers/)
- Services
- [IT Consulting](https://teamascend.com/services/strategic-consulting/)
- [Cybersecurity](https://teamascend.com/services/cybersecurity/)
- [IT Infrastructure](https://teamascend.com/services/infrastructure/)
- [Cloud](https://teamascend.com/services/cloud-computing/)
- [24/7 Support Desk](https://teamascend.com/services/infrastructure/support-desk/)
- [Microsoft Services](https://teamascend.com/services/microsoft-365/)
- [Salesforce Services](https://teamascend.com/salesforce-services/)
- [HubSpot Services](https://teamascend.com/services/hubspot-services/)
- [App Development](https://teamascend.com/services/application-development/)
### Empowering Technology. Powered by People.
Technology is critical to businesses across all industries. Today's technology must be smart, reliable, adaptable, and secure. At Ascend Technologies, we deliver solutions at the highest level, from cloud computing to proactive cybersecurity strategies to Salesforce excellence. And the team? As impressive as the tech. Our practical support is focused on one thing: your success. Let's see what we can do together.
[Contact Us](https://teamascend.com/contact/)
©2026 Ascend Technologies, LLC, All Rights Reserved | [Privacy Policy](https://teamascend.com/privacy-policy/)
```json
{
"@context" : "https://schema.org",
"@type" : "WebPage",
"breadcrumb" : {
"@type" : "BreadcrumbList",
"itemListElement" : [ {
"@type" : "ListItem",
"item" : "https://blog.teamascend.com",
"name" : "Home",
"position" : 1
} ]
},
"dateModified" : "2023-10-20T14🇲🇲55",
"description" : "Learn about the growing cyber threat that attackers use to make money… by taking yours.",
"name" : "Ransomware: How cyber attackers turn hacking into profit",
"primaryImageOfPage" : {
"@type" : "ImageObject",
"url" : "https://content.teamascend.com/hubfs/Blog%20Feature%20Images/110619_CyberattackSeries-06.jpg"
},
"publisher" : {
"@type" : "Organization",
"logo" : {
"@type" : "ImageObject",
"url" : "https://content.teamascend.com/hubfs/Ascend-Technologies-HubSpot-Logo.png"
},
"name" : "Ascend Technologies",
"url" : "https://blog.teamascend.com"
},
"url" : "https://blog.teamascend.com/blog/ransomware"
}
```