At 6:40 on a Monday morning, a file server stops accepting logins. By the time anyone reaches the office, half the shared drive has become unreadable filenames, and a text file in every folder is demanding payment in cryptocurrency. The next decision — whether this is ransomware that might be reversed or a wiper that has already destroyed the data — changes everything about the hours that follow.
From the outside, the two attacks look nearly identical. Underneath, they are built for different purposes and leave different fingerprints. Knowing which one you're facing tells you whether to preserve every last byte for decryption or move straight to rebuilding from backups.
What Each One Is Built to Do
Ransomware is a business. The attacker encrypts your files, keeps the key, and sells it back to you. That model only works if the data can theoretically be restored, so most ransomware families encrypt carefully and preserve enough structure to make decryption possible. Recovery, even without paying, is sometimes an option.
A wiper has no business model. Its purpose is destruction: sabotage, covering tracks, sending a message, or an insider's exit. Files are overwritten, partitions are dropped, boot records are wrecked. There is no key to sell, because none exists.
Wipers Wearing a Ransomware Mask
Some destructive attacks deliberately drop a ransomware-style note to slow you down while you hunt for a key that will never arrive. Others use ransomware tactics but lose the key, or never intend to hand it over. Treat any ransom note as a claim to verify, not a diagnosis.
Behavioral Differences You Can Actually Observe
You don't need a forensic workstation to spot the early clues. Look at the files themselves and at what the malware did around them.
- Filenames. Classic ransomware appends a unique extension or renames files to a patterned name. Wipers often leave names alone or rename thousands of files to the same generic string.
- File contents. Ransomware usually encrypts the body of a file while leaving a recognizable header or adding its own. Many wipers overwrite the whole file with zeros or random bytes, or shrink it to nothing.
- Ransom notes. Ransomware typically drops the same note in every affected folder. A single generic note in one location is a warning sign of a wiper.
- Boot and partitions. Machines that fail to boot, show missing partitions, or display a custom boot screen usually point to a wiper that targeted the boot record.
- Payment and support. Real ransomware operations maintain a payment site, a chat, and a free test decryption of one file. If the site is dead, the chat never replies, and no sample decryption is offered, don't count on a key.
One practical test: copy two or three corrupted files to external media and open them in a hex viewer. If a PDF still starts with its normal signature before turning into noise, you are probably looking at encryption. If the beginning is uniformly blank or random, that data is likely gone.
Reading the Ransom Note
The note is where attackers make promises. Read it for what it offers, not what it says. A functioning operation will give you a unique victim ID, a working contact address, and instructions to upload a small file for decryption. Vague templates with no identifier, no working contact, and a nonsensical deadline are more consistent with misdirection.
An attacker who cannot decrypt a single sample file cannot decrypt your business.
Keep the note, photograph the screen, and record timestamps. That evidence matters for insurance claims, police reports, and identifying which family you're dealing with. If personal data was involved, breach notification rules may apply in your jurisdiction — get guidance from a lawyer who knows your industry rather than guessing.
Recovery Odds: Where the Paths Split
For ransomware, recovery paths exist. Public decryption tools are released for some families, and backups may cover the gap. Even where no decryptor exists, some organizations recover partially by restoring older copies and accepting a window of loss. Paying is the worst option: it funds criminal operations, often invites a second demand, and still leaves you with no guarantee.
For a wiper, there is one path: restore. If your backups are intact, isolated, and tested, you rebuild. If they were encrypted alongside everything else, or reachable from the compromised network, you are facing permanent data loss and a long reconstruction project. This is why at least one copy of critical data should live offline or in write-once storage that no credential on your network can delete.
The First Hour: Steps That Help Either Way
- Cut the network, not the power. Unplug the cable or disable Wi-Fi to stop the spread, but leave machines running if you can. Encryption keys sometimes live only in memory, and a shutdown can destroy the one thing that makes recovery possible.
- Don't clean up. Resist the urge to delete ransom notes, "infected" files, or unfamiliar executables. Every artifact is evidence.
- Preserve before you restore. Image affected systems if you have the tools. Restoring over live data can erase the trail you need.
- Map the blast radius. Which shares, servers, and accounts are affected? What was switched off or offline at the time?
- Check backups without touching them. Confirm your copies are recent and clean before restoring. Writing corrupted data over good backups is a common, painful mistake.
- Bring in help early. Incident response specialists, your insurer's hotline, and law enforcement can all be engaged in parallel. Don't negotiate with an attacker on your own.
Build for the Worse Case
You often can't tell ransomware from a wiper in the first ten minutes, so prepare for both. Keep offline and immutable backups, segment your network so one infected laptop can't reach the file server, require multi-factor authentication everywhere, and patch internet-facing systems promptly. Rehearse a restore at least once a year — a backup you have never tested is a hope, not a plan.
Then write the decisions down before you need them: who isolates systems, who calls the insurer, who briefs leadership, who contacts law enforcement. When the ransom note appears, the calmest team in the building is usually the one that already knew what it would do.
Photo: Tumisu / Pixabay
