Spotting the Difference Between Malware and Ransomware
“Malware” and “ransomware” are often used as if they mean the same thing. They are related, but the difference matters, because ransomware can stop a business in a single morning. Here is a plain-English explanation and what to do about each.
What is malware?
Malware, short for “malicious software”, is any program designed to harm you or your systems. It is the umbrella term. Common types include:
- Viruses and worms that spread between files and computers
- Trojans disguised as useful software or attachments
- Spyware and keyloggers that record what you type, including passwords
- Info-stealers that grab saved passwords and browser sessions
- Adware that floods you with ads and slows your computer
Much malware tries to stay hidden for as long as possible, quietly stealing data or giving attackers a way in.
What is ransomware?
Ransomware is one type of malware, and the most damaging for most businesses. It locks your files by encrypting them, then demands payment for the key. Many groups now also steal a copy of your data first and threaten to publish it if you don’t pay.
Unlike most malware, ransomware wants you to know it is there. You find out when files won’t open and a ransom note appears.
The difference at a glance
| Malware (general) | Ransomware | |
|---|---|---|
| Goal | Steal data, spy, cause damage or open a way in | Extort money |
| Visibility | Usually hidden | Announces itself |
| Typical impact | Data theft, slow systems, account takeover | Business stops; data may be leaked |
How they get in
- Phishing emails with links or attachments
- Stolen or reused passwords, especially without MFA
- Unpatched software and remote access systems
- Fake downloads and malicious browser extensions
How to protect your business
- Turn on MFA for email, remote access and admin accounts.
- Patch quickly, especially internet-facing systems and web browsers.
- Use managed endpoint protection that is monitored, not just installed.
- Filter email and train staff to report anything suspicious.
- Limit admin rights so one click can’t compromise everything.
- Keep offline or immutable backups and test them. See our backup and recovery guide.
These steps map closely to the ASD Essential Eight.
If you think you’ve been hit
- Disconnect affected computers from the network, but don’t turn them off.
- Call your IT provider, and your cyber insurer if you have one.
- Don’t pay or contact the attackers before getting advice.
- Report it to the Australian Signals Directorate through cyber.gov.au.
Other types of malware worth knowing
- Remote access trojans: give an attacker hidden control of a computer, often for weeks before anyone notices.
- Botnet malware: quietly turns your computers into part of a network used to attack others or send spam.
- Cryptominers: use your computer’s processing power to mine cryptocurrency, slowing everything down and raising power bills.
- Wipers: look like ransomware but simply destroy data, with no way to get it back except from backups.
- Fileless malware: runs in memory using built-in Windows tools, which makes it harder for basic antivirus to spot.
Warning signs a computer may be infected
- It suddenly runs much slower, or the fan is constantly working hard
- Pop-ups, new toolbars or browser extensions you didn’t install
- Your security software has been turned off and won’t turn back on
- Colleagues or clients receive emails you didn’t send
- Unexpected password reset or sign-in alerts from your accounts
- Files that have been renamed, moved or won’t open
If you notice any of these, stop using the device for business accounts and call your IT provider. Acting early often turns a serious incident into a minor one.
Why ransomware gangs target small businesses
It is easy to assume attackers only go after big companies. In reality, most attacks are automated and look for any business with a weakness, such as an unpatched system or an account without MFA. Ransomware is now sold “as a service”, so criminals with little technical skill can rent the tools. Small businesses are attractive because they often have fewer protections, rely heavily on a handful of systems and may feel pressure to pay quickly. Attackers also use smaller suppliers as a way into their larger clients.
Common questions
Will antivirus stop ransomware?
Traditional antivirus helps, but on its own it is not enough. Modern endpoint detection and response (EDR) tools watch for suspicious behaviour, such as mass file encryption, and can stop it in progress, especially when someone is monitoring the alerts. Tested backups remain your last line of defence.
Should we pay a ransom?
The Australian Signals Directorate advises against paying. Payment does not guarantee your files will be restored or that stolen data will be deleted, and it marks you as a business that pays. Get advice from your IT provider, insurer and lawyers before any contact with the attackers. Larger businesses must also report ransomware payments to the ASD.
Can Macs get malware?
Yes. Macs are targeted less often than Windows computers, but info-stealers and other malware aimed at macOS are increasingly common. The same basics apply: keep the operating system and apps updated, only install software from trusted sources and use managed security software.
Want ransomware protection in place? See our managed IT security services, or read what to do in the first hour of a cyber attack.
How exposed is your business?
Our free cyber risk scan shows the gaps attackers look for, with a plain-English report on what to fix first.
Or call 1300 133 770.
