A ransomware campaign is coordinated criminal activity that uses encryption, disruption, or data theft to extort payment from a target. It is usually more than a single infected host: attackers may combine phishing, stolen credentials, exposed services, and vulnerability exploitation to gain access, then move through the network and deploy malware at scale.
This term matters because campaigns are organized for speed and pressure. Attackers often prioritize internet-facing systems, unpatched software, and unauthenticated flaws that can lead to remote code execution. Defenders look for early signs such as unusual administrative activity, suspicious scripts, disabled backups, and lateral movement. Reducing exposure, patching quickly, limiting privileges, and maintaining offline backups are key defenses against a ransomware campaign.