At a manufacturer, files on a design share are renamed and a note demands payment before those files can be restored. Which endpoint-attack category fits that outcome?

Ransomware holds files hostage, often by encrypting or renaming them, and demands payment for restoration. Renamed files on the design share plus a payment note match Ransomware that renames files on the share and demands payment before they can be restored. A buffer overflow that crashed one process and left the design files untouched on the share is memory corruption with a crash, and the files here were renamed and held for payment. A web-filter category assigned to a site the design team opened during the same shift is a control's label for a site, not a change to the files on the share. A NetFlow exporter failure that stopped conversation summaries from the design network stops flow records and does not rename files or demand payment. Judge the share outcome on its own, separate from any exploit that may have delivered the note. Exam caveat: the payment note plus the renamed files are enough to call the outcome ransomware; do not invent a malware family name from the wording of the note. Operational check: keep one note and one renamed file, and confirm offline backups exist before anyone restores the design share.