iTechGuides is reader-supported. When you buy through links on our site, we may earn an affiliate commission. As an Amazon Associate I earn from qualifying purchases. Learn more
Ransomware now controls more than whether a file opens. A serious intrusion can deny access to local and networked systems, steal data for publication, seize administrator accounts, and destroy the backups needed for recovery. The practical question is not simply “Were files encrypted?” but “Which layers of the organization can the attacker reach, and which recovery paths remain trustworthy?”
The four control layers ransomware can affect
Federal guidance describes ransomware as malware that prevents access to computer files, systems or networks and demands payment. Modern operations can extend that control across four connected layers.
| Control layer | What the attacker may affect | What it means for the victim |
|---|---|---|
| Availability | Local files, attached drives, network shares, endpoints, virtual machines and network services | People and applications cannot use systems or data, even when the underlying hardware still works. |
| Confidentiality | Copies of documents, credentials, personal information and other sensitive data | Restoring from a backup may not undo theft or the threat of publication. |
| Identity and administration | Ordinary, service, privileged and domain accounts; remote-management tools and policy systems | An attacker can move laterally, deploy malware broadly and change security controls before encryption appears. |
| Recoverability | Backup servers, archives, snapshots and disaster-recovery infrastructure | The organization may lose the clean restoration path it expected to use. |
What ransomware can lock or encrypt
Local and attached storage
The FBI says more advanced ransomware encrypts files and folders on local drives, attached drives and networked computers. That includes a workstation’s internal disk and storage connected through USB or another local interface. A machine can remain powered on while its business data is unusable.
Free tools Windows power users keep installed
One-click scans. No signup required.
Network shares and shared services
Yes, ransomware can encrypt network drives and shared folders when the compromised process has permission to write to them. The risk is determined by reachable paths and account privileges, not by whether the storage is physically inside the infected computer. Shared file servers, departmental shares and mapped drives can therefore be impacted from one initially compromised endpoint.
#1 Best Overall
Encryption is only one form of availability loss. Attackers can also interrupt access to systems or network resources by changing configurations, disabling services or taking virtual machines and management systems offline.
How data theft changes the incident
Encryption is no longer the only pressure tactic. NIST’s 2026 ransomware profile explains that attackers may steal an organization’s information and demand an additional payment in exchange for not disclosing it to authorities, competitors or the public. This is commonly called double extortion.
That creates two separate problems:
- Operational disruption: systems and data are unavailable.
- Confidentiality harm: copied information may already be in the attacker’s possession and may be published or sold.
In a 2026 advisory, Gunra actors were reported to encrypt and exfiltrate sensitive data, then threaten publication on a dedicated leak site if a victim did not pay within five to seven days. A separate 2026 update on Medusa described the same combination of encryption, exfiltration and publication threats. These cases show why a successful restoration does not automatically close the incident.
Official advisories do not establish one universal, cross-industry percentage for how often ransomware includes exfiltration. Prevalence figures from one operation or sector should not be treated as a general rate.
How attackers gain wider control before the ransom note
The visible encryption event is often the last stage of an intrusion. Joint guidance on Play operations documents several ways attackers expand their reach:
- Using valid accounts and stolen credentials.
- Exploiting public-facing applications and unpatched internet-facing systems.
- Entering through external remote services such as VPN or Remote Desktop Protocol (RDP).
- Dumping credentials with tools such as Mimikatz.
- Running PowerShell commands and transferring tools laterally.
- Using Group Policy to distribute actions across managed systems.
Medusa reporting also cites access brokers, phishing, remote-monitoring software and RDP. If an attacker obtains a privileged or domain account, the potential control surface expands from one device to identity systems, file servers, security tooling and policy-management infrastructure. The account’s permissions, active sessions and reachable network segments determine what can happen next.
Can ransomware delete or disable backups?
Yes. Backup systems are valuable targets because they determine whether the victim can recover without negotiating. Gunra reporting describes disabled backup features and an incident in which backup and archived data were deleted at both a primary data center and a disaster-recovery center.
Recommended Free Tools
A backup that is online, writable by production credentials or administered through the same reachable network can be altered during the intrusion. Isolation is therefore a recovery control, not merely a storage preference.
What a resilient backup design includes
- Offline copies: the FBI advises regular backups that are verified and disconnected from the computers and networks they protect.
- Immutable copies: use retention controls that prevent an attacker or ordinary administrator session from changing or deleting a protected recovery point.
- Physical or logical separation: keep a copy in a physically separate or strongly segmented location, including disaster-recovery infrastructure.
- Encryption: protect backup contents while stored and during transfer.
- Tested restoration: periodically restore representative systems and data; a backup that has never been restored is an assumption, not proof of recoverability.
- Separate administration: as an implementation consequence of isolation guidance, backup management credentials and access paths should not be the same as ordinary production credentials.
An external hard drive or encrypted SSD/HDD can serve as one offline copy for a small environment, but a consumer drive is not automatically immutable. It does not by itself provide enterprise retention, monitoring, multiple-copy governance or verified restoration. Disconnect it, protect it from unauthorized access and test the recovery process.
Independent reader supportYour contribution helps us test, update, and keep practical guides available for everyone.What current cases show about scale
A joint CISA, FBI and HHS update dated August 18, 2026 said Medusa actors had impacted more than 500 victims as of April 2026. Reported sectors included healthcare, the defense industrial base, critical manufacturing, government services and facilities, information technology and financial services, among others. The figure describes that advisory’s observed victims; it is not a prevalence estimate for all ransomware.
Five questions to ask during triage
- Availability: Which endpoints, shares, virtual machines and services are inaccessible, encrypted or offline?
- Confidentiality: What data was copied, and is there evidence of staging, exfiltration or a leak-site claim?
- Identity reach: Which ordinary, service, privileged or domain accounts were used or exposed?
- Recovery reach: Were backups, snapshots or archives accessed, disabled, altered or deleted?
- Operational resilience: Are network segments separated, detections working, continuity procedures available and restoration steps tested?
This checklist prevents an organization from declaring success merely because a few workstations have been decrypted.
Quick wins for a faster PC:
Repair Windows errors before they cause bigger problemsFix Now →Fix the driver behind crashes, sound loss and screen glitchesFind Drivers →Clear out junk files and repair common Windows errorsFree Scan →Controls that reduce the control surface
- Patch internet-facing systems promptly, with special attention to VPN gateways and RDP-exposed infrastructure.
- Segment networks so a compromised device cannot freely reach servers, backup systems and administrative interfaces.
- Use offline, immutable and encrypted backups in a physically separate or segmented location, and verify restoration.
- Limit administrative privileges, protect service accounts and keep backup-management access separate from production access.
- Maintain an incident-response and business-continuity plan that identifies who can isolate systems, contact responders and approve restoration.
- Report incidents to the FBI or CISA as appropriate and preserve evidence while containment proceeds.
Does paying guarantee that files will return?
No. The FBI states: “The FBI does not support paying a ransom in response to a ransomware attack. Paying a ransom doesn’t guarantee you or your organization will get any data back.” Attackers may fail to provide a working decryptor, demand additional payment or retain and publish stolen information. Payment therefore cannot substitute for independent, tested recovery capabilities or incident response.
Bottom line
Ransomware controls whatever the intruder’s accounts and tools can reach: data availability, shared infrastructure, identities, administrative systems, confidential information and sometimes the backups intended to save the organization. Defending against it requires treating those layers as one connected control surface and proving, through segmented and tested recovery, that an attacker cannot take all of them at once.
Quick Recap
Product prices and availability are accurate as of the date/time indicated and are subject to change. Any price and availability information displayed on Amazon at the time of purchase will apply.
