# What is Ghost, or Cring, ransomware?

Ghost, also known as Cring and by several other names, is a financially motivated ransomware operation that CISA, the FBI and the MS-ISAC described in joint advisory AA25-050A of 19 February 2025. According to the advisory, Ghost actors began their attacks around early 2021 and have compromised organisations in more than 70 countries, in sectors that include critical infrastructure, schools and universities, health care, government, manufacturing and many small and medium-sized businesses. They mostly gain access by exploiting known, often years-old vulnerabilities in internet-facing software such as firewalls, web servers and mail servers, for which patches had long been available. They also change their ransomware file names and ransom notes frequently, which makes the brand hard to track. The lesson is blunt: patching public-facing systems against known vulnerabilities, and replacing devices that no longer receive updates, is the main defence the advisory recommends.

FAQ: [Ransomware groups and families](https://netsenx.com/en/faq/ransomware-families) · https://netsenx.com/en/faq/what-is-ghost-cring-ransomware

## Read next

- https://netsenx.com/en/detect-ransomware-on-the-network
- https://netsenx.com/en/blog/2026-10-24_ransomware-protection

## Related questions

- [What is Interlock ransomware?](https://netsenx.com/en/faq/what-is-interlock-ransomware)
- [What is the difference between a ransomware family, a group and an affiliate?](https://netsenx.com/en/faq/difference-between-a-ransomware-family-group-and-affiliate)
- [What is ransomware as a service (RaaS)?](https://netsenx.com/en/faq/what-is-ransomware-as-a-service)
- [What is double extortion in ransomware?](https://netsenx.com/en/faq/what-is-double-extortion-ransomware)
- [What is a ransomware leak site?](https://netsenx.com/en/faq/what-is-a-ransomware-leak-site)