Ransomware
One click is enough. Everything stops.
Understand the speed of a ransomware attack: intrusion, propagation, encryption, and extortion. A visual simulation that makes you want to see it through.
- Wave encryption
- Double extortion
- Immutable backups
- Crisis plan
Step-by-step simulation
Follow the attack step by step
Hi Pierre, please find attached the March vendor invoice for approval before quarter-end closing.
An email with an attachment
The sender looks internal. The attachment is a Word file with a macro.
The .docm file silently triggers the ransomware download in the background. The user just sees a blank document — the payload is already in memory.
Key figures
An attack that can bring an organization to a halt
- To trigger access
0 click
phishing, macro, fake VPN- To encrypt a server
< 0 min
automated lateral propagation- Exfiltration + encryption
0 phases
double extortion
Protection
How to protect yourself
You don't negotiate with ransomware: you make it ineffective before it strikes.
Offline, immutable backups
3-2-1 rule with a disconnected or immutable copy, and restores tested regularly.
Patching and reduced exposure
Patch exposed services first (VPN, RDP, email) and close those that don't need to be open.
EDR and segmentation
An EDR stops mass encryption; segmentation keeps it from spreading from one server to the next.
A rehearsed crisis plan
Who decides, who isolates, who communicates: a written, rehearsed plan cuts days off the downtime.
Immersive demo
Live through the crisis minute by minute
Enable the defenses, watch the propagation, and see how immutable backups change the outcome.
An ordinary email. An attachment. A single click is enough.
Real-world example
A lightning-fast attack.
In 2017, WannaCry hit more than 200,000 machines worldwide. Hospitals, factories, and public services were paralyzed. A patch existed, but it wasn't deployed everywhere.
The lesson
- Fast patching of critical systems
- Network segmentation to limit propagation
- Immutable backups tested regularly
What changes the outcome
- EDR detection
- Isolation within minutes
- Immutable backups
- Faster recovery
- Crisis plan
- Clear decision-making
- Communication
- Informed customers
Objective
Reduce detection time and restore without paying. Every minute saved avoids escalation.
FAQ
Frequently asked questions
What is a ransomware attack?
Ransomware is malware that encrypts a system's files and demands a ransom to provide the decryption key. It typically spreads via phishing emails, malicious attachments, or unpatched vulnerabilities.
How does ransomware spread across a corporate network?
Ransomware uses lateral movement techniques: it exploits cached credentials (Pass-the-Hash), SMB network shares, and spreads toward Active Directory. It prioritizes the domain controller, file servers, and backups to maximize impact.
What is ransomware double extortion?
Double extortion is a technique where the attacker exfiltrates confidential data BEFORE encrypting it, then threatens to publish it on a leak site if the ransom isn't paid. This creates dual pressure: data restoration AND reputation protection.
How do you protect against ransomware?
Essential protections include: offline immutable backups (3-2-1 rule), network segmentation, EDR/XDR, least-privilege principle, MFA on all access, patch management, and a regularly tested incident response plan.
Train your teams with an expert
Tailored awareness workshops, attack simulations and training to anchor the right reflexes in your organization.