The anatomy of a ransomware attack, stage by stage

how the criminal economy works

Modern ransomware operations do not work the way the popular image suggests. A lone attacker who finds a target, breaks in, encrypts the files, and collects payment describes a small fraction of what actually happens. The infrastructure behind ransomware is specialised. Different actors handle different parts of the chain, and they exchange services in organised markets.

Initial access brokers are one of the most consequential roles in this economy. They are not ransomware operators and do not encrypt files. They specialise in gaining entry to systems, then selling that access to other groups. A compromised set of credentials, a foothold established through a phishing campaign, an exposed remote desktop service with weak authentication: all of these are commodities. They are listed, priced, and sold. The ransomware group that eventually encrypts an environment may have purchased access rather than obtaining it themselves.

Ransomware-as-a-service (RaaS) is the distribution model used by many of the largest operations. A RaaS operator builds and maintains the tooling and infrastructure. Affiliates license it, conduct attacks, collect ransoms, and pay a percentage back to the operator. The arrangement mirrors a franchise model, which lowers the technical barrier to conducting a ransomware attack because the affiliate does not need to build the tooling from scratch.

The practical implication for defenders is that the group that encrypted an environment may not be the same group that sold the original access, which may not be the same group that built the malware. Defenders are not facing a single actor. They are facing an economy with division of labour. Understanding the stages of an attack is how defenders map their controls to this economy and identify where the chain is weakest.

stage 1: initial access

The attack begins when an attacker establishes a first foothold. The route in varies, but the dominant vectors are consistent. According to Verizon DBIR data, phishing and stolen credentials are the leading initial-access vectors. Phishing delivers a malicious payload or harvests credentials by directing a user to a credential capture page. Stolen credentials, obtained from prior breaches at other services or through credential-stuffing attacks, are used to authenticate directly. A third significant vector is exploited vulnerabilities in internet-facing applications. Purchased access from initial access brokers is a fourth path.

Multi-factor authentication is the most direct control at this stage. MFA blocks the path from compromised credential to successful login. Microsoft's research puts the proportion of account-compromise attacks blocked by MFA at more than 99.2%. Without MFA on the affected account, a compromised credential is not an obstacle at all. Credential hygiene matters alongside MFA: reused or breached passwords are actively sold and tested, and password managers and enforced policies reduce this surface. Vulnerability management closes the technical entry points through timely patching of internet-facing systems and removal of exposed services. Offboarding access to former employees removes another category of entry point; an account left open after a departure is available across the entire dwell-time window.

stage 2: reconnaissance

Once inside, the attacker's first priority is understanding the environment. This stage does not look like an attack from inside the network. It looks like normal activity. The attacker maps what systems exist, what accounts have elevated privileges, what data is present and where it lives, and what the network topology looks like. Reconnaissance typically involves querying internal directories to identify domain administrators and domain controllers, scanning internal subnets, and reviewing what credentials and session tokens are available on the compromised machine. This stage can extend over days or weeks without triggering alerts if monitoring is limited or absent.

Behavioural monitoring and anomaly detection are the relevant controls. A compromised account querying Active Directory for domain administrators, scanning internal subnets, or accessing systems it has never accessed before is exhibiting behaviour that differs from its baseline. Endpoint detection and response (EDR) tools and SIEM solutions configured with meaningful baselines can surface this activity, provided the monitoring is in place and reviewed. Network segmentation limits what reconnaissance can discover, constraining what an attacker can see and reach from any given starting point.

stage 3: establishing persistence

Having mapped the environment, the attacker creates additional footholds so that closing any single entry point does not remove their access. Persistence mechanisms include creating new accounts, installing backdoors, modifying startup processes, and establishing command-and-control channels. An organisation that closes the original entry point without understanding the full scope of the intrusion will find the attacker still present through these secondary mechanisms.

Identity monitoring is the primary control here. New accounts created outside normal provisioning processes are a direct indicator of compromise. An account provisioning alert, or a periodic review of recently created accounts that identifies accounts with no corresponding HR record, is one of the most direct detection mechanisms available. Monitoring for new admin-level accounts is particularly important, since attackers establishing persistence typically attempt to create high-privilege accounts. Any admin account created outside a change-management process warrants immediate investigation.

stage 4: privilege escalation

Most initial access arrives at a standard user level, which is insufficient for the later stages. Privilege escalation is the process of moving from standard access to administrative or domain-level control. Common methods include exploiting local vulnerabilities, harvesting credentials from memory, finding credentials stored in plaintext, and identifying service accounts or administrative tools left with excessive access. This stage is where the state of the privilege model matters directly: an environment where administrative credentials are used for routine tasks, where service accounts carry broad access never reviewed, and where there is no concept of least privilege provides escalation paths at every turn.

Least-privilege access design is the structural control. If accounts are provisioned only with the access they need, the paths available for escalation are narrower. Privileged access management (PAM) adds a layer above least privilege: just-in-time privilege grants, session recording, and approval workflows mean that obtaining a standard credential does not automatically provide a path to domain administrator. Regular access reviews surface accumulated privilege. Temporary admin access granted for a project that ended six months ago, never reviewed and never revoked, is an escalation path that would not exist in an environment with a functioning quarterly review cycle for privileged accounts.

stage 5: lateral movement and data collection

With elevated privileges, the attacker moves through the network to reach the systems holding the most valuable data, the systems whose encryption will be most disruptive, and the credentials needed to deploy ransomware broadly. Lateral movement uses legitimate administrative tools and protocols, blending with normal administrative activity. While moving, the attacker collects data for potential exfiltration and builds a target list for the eventual encryption deployment.

Network segmentation limits lateral movement even after escalation. An attacker with domain administrator credentials in one segment does not automatically reach production systems, financial data, or backups in a properly segmented network. Monitoring for lateral-movement indicators, including unusual use of remote administration tools and bulk file access, provides detection opportunities, because the attacker is active and that activity is visible to monitoring systems looking for it. Backup isolation is relevant here: backups that are isolated, immutable, and not reachable from the same credential store as production cannot be encrypted or deleted in the same lateral-movement sweep.

stage 6: exfiltration

Before deploying ransomware, most professional operations exfiltrate data. The purpose is double extortion: demand a ransom for the decryption key and threaten to publish the exfiltrated data if payment is not made. Double extortion retains leverage even against organisations that have tested backups and could otherwise recover without paying. Exfiltration involves staging data on an internal system, then transferring it out through legitimate file-transfer utilities or cloud storage. The transfer itself is detectable if outbound data-volume monitoring is in place.

Data loss prevention (DLP) and outbound traffic monitoring are the direct controls. Alerts on large outbound transfers to unusual destinations, or on file-transfer utilities used outside normal business patterns, provide detection opportunities. The practical challenge is that exfiltration uses the same protocols and tools as legitimate business activity, so tuning anomaly detection to surface genuine exfiltration without excessive false positives requires baseline knowledge of normal outbound activity.

stage 7: encryption and extortion

With data exfiltrated and the environment mapped, the attacker deploys ransomware. In a well-prepared operation, deployment is coordinated across the environment simultaneously, using domain administrator privileges to push the payload via standard administrative mechanisms. Files are encrypted, ransom notes appear, and systems go down. The timing is deliberate: attacks are frequently deployed at times of minimum IT staffing, on weekends, public holidays, and evenings, to maximise the window before discovery.

Recovery without paying depends on the quality of the backup position. Tested, immutable backups are the last structural control. Immutable means the backup storage cannot be modified or deleted by the same credentials used to compromise production. Tested means the restore process has been run and the recovery time objective is understood. Offline or air-gapped backups provide an additional layer. Incident response planning determines how quickly the organisation can contain the attack and begin recovery; pre-rehearsed roles reduce the chaos of the first hours. Paying ransom is not a recovery strategy. Payment does not guarantee decryption, does not remove exfiltrated data from the attacker's possession, and signals to the criminal market that the organisation is willing to pay.

the throughline: identity and access visibility

Reading through these stages, a pattern is consistent: most chains start at an identity weakness and are extended by access weaknesses. Initial access comes through compromised credentials or an account that should not have been active. Reconnaissance proceeds because the compromised account has broader directory access than it needs. Persistence is established through new accounts that no one notices. Escalation succeeds because privileged access is not well controlled. Lateral movement proceeds because the network does not separate what can reach what. Backup encryption succeeds because backup credentials are not isolated from production.

None of these are exotic findings. They are the conditions that exist in most environments when no one has done a deliberate inventory of what access exists, what it is used for, and what should be there. Visibility is not a sufficient defence on its own, but it is the prerequisite. An organisation that knows exactly which accounts exist, which have admin rights, where MFA is and is not enforced, and what has been left open from past departures has something to act on. An organisation without that picture cannot prioritise what to fix.

how this maps to soc 2, iso 27001, nis2, and dora

Ransomware defence is not a separate compliance category. The controls that interrupt the attack chain, MFA, least privilege, access reviews, network segmentation, backup integrity, monitoring, and incident response, map directly to the requirements of the major frameworks.

SOC 2 addresses logical access controls (CC6.1, CC6.2, CC6.3), system monitoring (CC7), and change management (CC8). ISO 27001:2022 addresses access control policy and management (A.5.15, A.5.18), cryptographic controls (A.8.24), network segmentation (A.8.22), backup (A.8.13), vulnerability management (A.8.8), and incident management (A.5.24, A.5.26). NIS2 (Article 21) requires covered entities to implement multi-factor authentication, access control policies, network segmentation, backup and recovery procedures, and incident handling. DORA (Article 9) specifies ICT security requirements for financial entities including access control, privileged access management, endpoint protection, and tested business continuity, and it explicitly addresses immutable backup requirements. Meeting these frameworks does not guarantee immunity, but the controls they require are exactly the controls that interrupt the attack chain at multiple stages.

common gaps attackers rely on

The attack sequence above assumes attackers will find these conditions, and they frequently do.

MFA not enforced on all accounts: partial deployment, where email has MFA but VPN does not, where admin accounts were excluded, or where legacy accounts predate the policy, leaves entry points open. Stale accounts from former employees retain their last-known permissions; an admin account belonging to a developer who left eighteen months ago is an accessible set of credentials no one is monitoring. Privileged accounts used for routine tasks are exposed to phishing and credential theft regularly; separate administrative accounts reduce that exposure. Flat networks give an attacker who has escalated to domain administrator access to everything; segmentation limits the blast radius. Backups reachable from the same environment, connected to the same directory and reachable via the same credentials as production, are available for encryption in the same sweep; backup isolation is the control. Incident response that exists only on paper fails in the first hours that matter; rehearsed roles and a tested playbook contain incidents faster.