This paper proposes a Digital Twin (DT)-driven framework to proactively combat ransomware in IoT ecosystems by simulating ransomware propagation, detecting anomalies via federated learning, and triggering automated responses such as device isolation and firmware rollbacks. A smart city case study demonstrates the framework’s effectiveness, achieving a 78% reduction in infections and a detection latency of 2.4 s. By integrating lightweight cryptography for edge devices and blockchain for secure firmware rollbacks, the system ensures both efficiency and security. Experimental results show that the proposed DT-enhanced federated learning approach achieves an F1-score of 0.96 and an AUC of 0.97 (12.4% improvement over baseline), with a 38% reduction in false positives and detection precision of 99%. The framework reduces recovery time from 112 min to 8.3 min and cuts downtime costs from $387k to $14.5k per incident. Rollback latency is minimized to 1.1 s using hybrid storage, meeting real-time requirements for critical infrastructure. The framework addresses critical challenges, including rollback delays and synchronization consistency, while optimizing performance through local caching and hybrid storage solutions. Despite its advantages, challenges like resource constraints and real-time validation in latency-sensitive applications remain. Ethical risks are mitigated through Azure Confidential Ledger encryption, ensuring compliance with GDPR and HIPAA. Future work will focus on self-learning models and edge-native blockchain architectures to further enhance resilience and scalability in healthcare, energy, and transportation sectors. This approach shifts IoT security from reactive patching to proactive threat mitigation.