Overview
Ransomware is a form of financially motivated organized cybercrime that essentially "holds information hostage." Ransomware code is installed and deployed onto devices, which can occur in numerous ways, most commonly through successful social engineering attempts such as phishing emails. After the ransomware is installed and deployed on the device, the victim then loses access to files and data stored on the computer, including the network it's connected to. Some attacks may also involve attackers exfiltrating data and then extorting the affected entity by threatening to publish or sell the stolen data.
After an attack has taken place, the victim typically does not notice what has occurred until an attempt is made to access the locked data, or the attackers leave a "ransom note" digitally on the screen. Unless the stolen data has been securely backed up prior to the attack, the victim is limited in what they can do to recover it. Within the ransom message, information is included on where and how to make the ransom payment. Typically, ransom payment is made through cryptocurrency due to the anonymity. If a payment is made, the victim may receive an encryption key to decrypt the data that was locked. Encryption keys aren't always given to the victim after they make their payment, and even if one is, it still may not work.
Critical Infrastructure and Citizens
Anyone may be a target of a ransomware attack; however, Virginia is home to many organizations that are prime targets. Ransomware attacks in the past have targeted critical infrastructure such as our state and municipal governments, healthcare, financial industry, and school systems/universities. In 2025, Virginia felt the impact of the growing ransomware issue.
In February 2025, the Virginia Office of the Attorney General was the target of a cyber-attack, which as a result, reportedly blocked employee access to essentially all computer systems, forcing the office to work without access to any of its software and stored data.
In June 2025, Manassas Park City Schools and the Albemarle County Government were both targeted in attacks. MPCS stated certain personal information in their systems may have been compromised including "full name or first initial and last name combined with a Social Security number, passport number or financial account information." Albemarle County Government had "the data of local government and public-school employees" impacted by a separate incident.
Most notably in 2021, the Colonial Pipeline, the largest refined petroleum products pipeline by volume in the United States, was targeted by a ransomware attack which impacted the entirety of the eastern seaboard by forcing the company to shut down its line. This incident serves as a reminder of how critical cybersecurity is and how threatening ransomware can be to Virginia.
Current Outlook & Emerging Trends
Ransomware will continue to be a threat to Virginia's citizens and critical infrastructure. Beyond just phishing attempts through email, recent reports from the FBI IC3 indicate that organized cybercrime groups such as "Scattered Spider" are relying on social engineering and "vishing" by posing as IT or contracted help desk staff to gain access to company credentials and systems. Software legitimately used by IT and remote support is being utilized through this process, whereby employees ultimately end up providing remote access to their computers and company networks to the cybercriminals unknowingly.
Entities with little to no cybersecurity posture will continue to be ideal targets; however, ransomware does and will continue to pose a significant threat to the Commonwealth and the nation, with the ability to disrupt not just critical infrastructure but also community lifelines such as emergency and 911 services, food and water distribution, health and medical systems, cell service, transportation, and systems facilitating supply chains and distribution. With the capability of causing major disruptions, in certain circumstances, ransomware attacks may be used in support of other criminal or terroristic activity to disrupt response and recovery efforts.
Law Enforcement Recommendations, Prevention, & Resources
Free resources are available and offered by many organizations to individuals and companies to educate themselves on the threats and prevention of ransomware attacks. Companies and individuals are encouraged to:
- Enable Two Factor Authentication (2FA) on accounts.
- Backup data in case of a successful attack. Victims who backed up their data are able to avoid having to pay a ransom.
- Do not download or open unknown files from unexpected emails.
- Be conscious of physical security features. Maintain a facility that is secure such as implementing access cards or controlled access to sensitive hardware.
- Maintain a private social media. "Vishing" and "spearphishing" utilizes social media information of employees to conduct targeted phishing.
If impacted by ransomware, contact your local law enforcement and the FBI Internet Crime and Complaint Center (IC3) at www.ic3.gov. Critical Infrastructure and State entities should report cyber or ransomware incidents to the Virginia Fusion Center at reportcyber.virginia.gov in accordance with Virginia State Code Section 2.2-5514.
VFC Shield Members are encouraged to take advantage of free resources and training offered at the following links:
Ransomware attacks will continue to impact everyday life and seek the easiest targets, however, creating and utilizing prevention and response strategies will allow for a continuity of operations and making yourself and/or organization a hardened target.
Sources:
- 2024 Cisco Cyber Threat Trends Report, https://www.cisco.com/c/dam/en/us/products/collateral/security/cyber-threat-trends-report.pdf
- Albemarle County Government, https://www.albemarle.org/Home/Components/News/News/1157/1681
- Washington Post, https://www.washingtonpost.com/dc-md-va/2025/02/12/virginia-attorney-general-cyber-attack/
- Associated Press, https://apnews.com/article/attorney-general-jason-miyares-cyberattack-0cf74a899064a72d4532fb0c38f8e382
- Comparitech, https://www.comparitech.com/news/ransomware-gang-says-it-hacked-the-virginia-attorney-general/
- WUSA9, https://www.wusa9.com/article/news/crime/mpcs-warnings-data-attack-personal-information-may-accessed/65-97a69a89-564e-4f98-88bb-3c957436d334
- CISA, https://www.cisa.gov/news-events/news/attack-colonial-pipeline-what-weve-learned-what-weve-done-over-past-two-years
- FBI Internet Crime Complaint Center, https://www.ic3.gov/CrimeInfo/Ransomware
- Scattered Spider Joint Cybersecurity Advisory, https://www.ic3.gov/CSA/2025/250729.pdf
- Colonial Pipeline, https://www.colpipe.com/our-operations/
- Mitre Attack, https://attack.mitre.org/versions/v17/techniques/
