Library file servers show mass encryption and a payment note. Which term names this behavior?
Select an answer to reveal the explanation.
Short Explanation
The catalog servers are locked and someone left a bill on the desk. Encryption plus extortion is ransomware—not the vague word malware, and not proof the files already walked out. Name the behavior you can see.
Full Explanation
Library file servers showing mass encryption and a payment note are ransomware, because civic data was encrypted for extortion. Encryption plus a bill on the desk is the behavior that earns the specific term; vague "malware" underspecifies what responders must do next. A ransom note does not by itself prove exfiltration already occurred, and identity reset alone is not required to encrypt files.
Calling it generic malware with no more specific term required fails by concept: the behaviors uniquely match ransomware and should be named. Calling it exfiltration because a ransom note always means data already left fails by concept: notes do not prove prior theft. Calling it account takeover because only an identity reset can encrypt files fails by concept: encryption can proceed via malware on reachable shares without that narrow premise.
Exam caveat: Mass encryption + extortion note = ransomware; do not weaken to generic malware or assume exfil from the note alone.
Operational check: Isolate shares, preserve ransom note and samples, determine encryption scope via ES file and endpoint telemetry, activate backup restore plans for catalog systems, and open a parallel question of whether data was also stolen—without assuming it from the note.