Crypto-ransomware is malware that encrypts files or entire systems and then demands payment in exchange for a decryption key or recovery help. The goal is extortion: by making data unreadable, attackers pressure victims to pay because normal operations are disrupted and backups may be incomplete, offline, or also targeted.
In practice, crypto-ransomware is often the visible end of a broader intrusion. Attackers may first steal credentials, move through a network, disable defenses, and identify valuable systems before launching encryption. That is why defenders focus on earlier warning signs such as unusual privilege use, lateral movement, backup tampering, and suspicious encryption activity. Strong segmentation, tested backups, endpoint detection, and rapid incident response can reduce the impact of this type of attack and may stop the final lockout before it spreads.