Ransomware rarely spreads because one employee simply clicks one bad file and every system instantly encrypts. Modern incidents are often multi-stage intrusions. Attackers obtain an initial foothold, establish persistence, steal or elevate credentials, discover the network, disable defenses, exfiltrate data, and only then deploy encryption or another extortion mechanism at scale.
Understanding that chain is useful because defenders get several chances to stop it.
Stage 1: Initial access
Common entry paths include:
- stolen credentials for VPN, remote desktop, email, or cloud services;
- phishing and social engineering;
- exposed services with weak configuration;
- unpatched internet-facing vulnerabilities;
- malware already present on an endpoint;
- trusted suppliers, remote-management tools, or compromised updates.
The first control is exposure reduction: inventory internet-facing systems, remove services that do not need to be public, patch high-risk vulnerabilities quickly, and enforce phishing-resistant MFA on remote and administrative access. CISA specifically advises against exposing services such as RDP directly to the internet without appropriate compensating controls.[1]
Stage 2: Persistence and command access
A foothold is useful only if it survives. An intruder may create accounts, register applications, alter startup behavior, deploy remote-management software, or steal session tokens. Some techniques resemble legitimate administration, which is why a simple malware alert is not the whole detection strategy.
Useful defenses include endpoint detection, application control, centralized identity logs, alerts for new administrators and MFA methods, restricted scripting, and review of newly installed remote tools.
Stage 3: Credential theft and privilege escalation
Attackers seek passwords, password hashes, cloud tokens, browser sessions, service-account secrets, and backup credentials. They may exploit a local vulnerability or abuse excessive permissions.
Separate administrator and everyday accounts. Use unique local administrator credentials, protect privileged sessions, minimize standing privilege, and avoid placing secrets in scripts or shared folders. Treat identity systems as critical infrastructure: if the directory or cloud identity provider falls, many downstream controls can be changed centrally.
Stage 4: Discovery and lateral movement
The attacker maps hosts, shares, users, security products, virtualization platforms, backups, and high-value data. Stolen credentials and normal administration protocols can make lateral movement look deceptively ordinary.
Network segmentation limits reach. Identity segmentation is equally important: one workstation administrator should not automatically control servers, backups, or the directory. Monitor unusual remote logins, rapid host-to-host connections, large directory queries, and administrative tools used from unexpected systems.
Stage 5: Defense evasion and backup sabotage
Before the visible event, intruders may disable security agents, clear logs, delete snapshots, corrupt backup catalogs, or compromise the accounts used to manage recovery systems. A backup connected with permanently powerful credentials can be encrypted like any other resource.
Use immutable or offline recovery copies, separate backup administration, MFA, deletion protection, monitored configuration changes, and restoration tests. “Backup completed” is not the same as “recovery works.”
Stage 6: Data theft
Many operations steal data before encryption. The attacker then threatens publication, customer notification, or regulatory consequences. CISA describes this combination as double extortion and notes that some incidents use data theft alone.[1:1]
Monitor unusual archive creation, high-volume outbound transfers, new cloud-sharing links, and access to data outside a user’s normal role. Apply data minimization: data you do not retain cannot be stolen later.
Stage 7: Deployment and impact
With privileged access, attackers can distribute ransomware through software-deployment systems, scripts, domain policies, remote tools, or hypervisor management. The program may stop services, encrypt local and network data, and leave ransom instructions. Other attackers destroy data or lock systems without conventional file encryption.
At this stage, rapid isolation matters. Disconnect affected systems in a coordinated way, protect unaffected network segments and backups, switch to out-of-band communications if the intruder may monitor corporate systems, and activate the incident-response plan.
What to do during an incident
Priorities vary, but a defensible sequence is:
- Confirm scope and declare the incident.
- Isolate affected systems and identities while preserving evidence.
- Protect backups, identity infrastructure, management platforms, and unaffected segments.
- Use a clean communication channel.
- Preserve volatile data and logs where qualified responders can do so safely.
- Identify initial access and persistence—not just the ransomware binary.
- Meet legal, contractual, insurance, regulatory, and law-enforcement obligations.
- Recover from known-good systems and rotate compromised credentials.
- Monitor intensively for re-entry.
Do not assume that decrypting files removes the intruder. Ransomware may be the last visible action of a longer compromise.
Five controls with disproportionate value
- Phishing-resistant MFA on email, VPN, cloud, and administration.
- Fast remediation of exposed vulnerabilities based on active exploitation and asset importance.
- Segmentation and least privilege across users, endpoints, servers, and backups.
- Protected, tested recovery with immutable or offline copies.
- Centralized telemetry and practiced response so suspicious activity is noticed before encryption.
The bottom line
Ransomware is an intrusion lifecycle, not merely a malicious file. Prevention and response improve when organizations defend identities, administration paths, backups, data, and network boundaries together—and rehearse the moment when one layer fails.
Sources
CISA, FBI, NSA, and MS-ISAC, #StopRansomware Guide. ↩︎ ↩︎