Phishing vs. Ransomware: Comparing Two Major Cyberattacks

In May 2017, the WannaCry ransomware attack locked hospital computers across the United Kingdom's National Health Service, forcing staff to turn away patients and cancel surgeries, all within hours. Ransomware and phishing are two of the most common cyberattacks in the world, and they are often confused with each other, even though they work very differently and demand very different defenses.

By the end of this lesson you will be able to: - Define phishing and ransomware and explain the goal of each - Compare how each attack tricks or damages its target - Identify real warning signs of a phishing email - Explain why backups are the single best defense against ransomware

Phishing is a social engineering attack: an email, text, or website disguised to look like it comes from a trusted source, like a bank or a coworker, designed to trick you into typing a password or clicking a malicious link. Phishing does not exploit software flaws, it exploits human trust and urgency. A 2023 Verizon data breach report found phishing was involved in over 30 percent of breaches that year.

Ransomware is malicious software that encrypts a victim's files, making them unreadable, and then demands payment, usually in cryptocurrency, for the decryption key. Unlike phishing, which relies on tricking a person, ransomware often spreads automatically once it gets a foothold, sometimes through a phishing email's attachment, sometimes through an unpatched software vulnerability. WannaCry infected over 200,000 computers in 150 countries in a single weekend by exploiting a Windows flaw called EternalBlue.

Phishing usually targets a single person's credentials and can be stopped by that person recognizing the trick. Ransomware often targets an entire network and can spread on its own, meaning even careful employees can be affected if just one coworker clicks a bad link. Phishing's cost is often stolen data or money; ransomware's cost is often a locked-down business, sometimes for days or weeks, plus a ransom demand.

Against phishing, the best defense is verifying urgent requests through a second channel, like calling the sender directly, and checking a link's real destination before clicking. Against ransomware, the single most effective defense is maintaining offline, regularly tested backups, so that even if files are encrypted, an organization can restore them without paying. Security teams also patch software quickly, since many ransomware strains spread through known, unpatched vulnerabilities.