Ransomware: How It Actually Encrypts

• Serious ransomware uses a hybrid scheme — fast symmetric crypto for files, strong asymmetric crypto to protect the keys:
• Generate a random AES key per file (fast bulk encryption).
• Encrypt each AES key with the attacker's RSA public key.
• Only the attacker's RSA private key can recover the AES keys.
• This is why "just brute force it" fails — and why decryptors exist only when the crypto is flawed or keys leak.
• Impact amplifiers:
• Shadow-copy deletion: vssadmin delete shadows, wbadmin — kills local restore.
• Stop backup/DB services, disable recovery, clear logs.