What is ransomware? Ransomware is a malicious software designed to hold a user’s files (such as healthcare records, financial contracts, manufacturing blueprints, software code, and other documents) for ransom by encrypting them and demanding the user pay a fee (often in Bitcoin) to decrypt them. How ransomware works Attackers initiate attacks using an array of tactics. Ransomware infections often first begin with an exploit kit — which are software kits designed to identify software vulnerabilities on endpoints and then upload and execute malicious code on the endpoint. Although variants of ransomware behave differently — there are many ways that Cisco can help.