A ransomware family is a related group of malware variants built from a common codebase or operator toolkit. Members of the family usually share core behavior: they infect a system, encrypt files or machines, and then demand payment for a decryption key or restoration tool. Variants may differ in file extensions, delivery methods, or evasion features, but they keep the same criminal purpose.
This term matters in cyber security because families often spread across multiple platforms and environments, such as endpoints, servers, and virtualization hosts. Defenders use family-level analysis to recognize shared indicators, block known loaders, tune detections, and build recovery plans around likely attacker behavior. In real attacks, identifying the family helps responders estimate impact, isolate affected assets, protect backups, and decide whether systems can be restored without paying.