Cybercriminals follow a series of steps before demanding a ransom from their victims.
According to the INTERPOL African Cyberthreat Assessment Report 2026, attackers begin by researching potential targets and looking for weaknesses they can exploit.
They often gain access through phishing emails or stolen login credentials before deploying ransomware into a victim’s system. Once inside, they scan the network to identify valuable files and connected devices.
The malware then encrypts files, making them inaccessible to users.
Finally, the attackers send a ransom note demanding payment in exchange for restoring access.
A ransomware attack is a cyberattack that locks a victim’s files or systems until a ransom is paid, highlighting the importance of strong cybersecurity and user awareness.
