A ransomware attack on a company: how it runs and how to spot it earlier

Ransomware, meaning malicious software that encrypts data and demands a ransom, gets into a company by three main routes: phishing, a vulnerable service exposed to the internet, and valid stolen credentials that the attacker simply signs in with. Each of the three is only the way in, not the end of the attack. What follows is the chain that leads from one machine to the whole domain.

Phishing aims at the person, not at the technology, which is what makes it such an easy way in. One click, or one password typed into a spoofed page, and the attacker has the first access. The details belong to the article on phishing that gets past MFA. Here it is enough that this is an entry point, not the end.

The second route is a forgotten or unpatched service on the perimeter: an old VPN, an exposed management interface, a system nobody has patched in years. The third is valid accounts, bought or taken from earlier breaches, that the attacker signs in with directly, without cracking anything. How to spot such an account from an earlier breach before the attacker does is described in a separate glossary entry.

One compromised computer isn’t enough for the attacker, because ransomware pays off only where it hits everything. What follows is lateral movement, meaning progress from the first machine to the next, and privilege escalation toward Domain Admin.

Lateral movement, meaning moving between computers on the network under credentials already obtained, and escalation in Active Directory are exactly what a red team and an attacker both look for. We don’t go into the specific techniques here. Where the escalation runs all the way to Domain Admin is described in a separate article on five real paths.

The principle is always the same: from an ordinary account the attacker gets to an account with higher privileges, with that one to further accounts, and finally to Domain Admin, which controls everything. From that moment ransomware can be deployed on all machines at once, not one by one.

Encryption isn’t the first step but the last. Between the moment the attacker gets in and that step lies a stretch of time called dwell time, counted in days and weeks rather than minutes. The attacker uses it to walk the network, find the backups, and prepare the strike so the company won’t manage to stop it.

Stealing data before the encryption belongs to that time as well. With double extortion the attacker copies the data out to have a hold even over a company that keeps backups: pay, or we publish it. The encryption itself is then only the visible end of something that ran hidden long before.

Dwell time is precisely the opportunity for the defense. The attacker isn’t invisible on the network, and the movement and the attempts at escalation leave traces. Anyone who can read them has several days to stop the attack before the encryption starts.

An offensive test walks the same chain as the attacker, only without the damage at the end. An internal network pentest and a red team both look for exactly the paths ransomware takes from the first computer to Domain Admin. The difference is where each of them starts and what it measures along the way.

A red team starts where a real attack continues: from the position of someone who is already inside. An operation run along the same chain as a real attack measures not just whether the path exists but whether your detection notices it. An internal infrastructure test is then the place where we search the internal network for the attacker’s path systematically.

What a test doesn’t give is a guarantee. There is no test after which ransomware stops being a threat. What it gives is a list of the specific paths an attacker would use, and the order in which to close them. That is the difference between doing something and doing the thing that matters.

Every step of the chain has a weak spot you can push on. Defense against ransomware isn’t one tool but breaking the chain in several places, so the attacker can’t get through all of them. The five measures below sit at different links of that chain, from the way in to the backups.

• Phishing-resistant multi-factor authentication (MFA), meaning a second factor bound to the device: it closes the way in through a stolen password, because the password on its own is then not enough.
• Network segmentation: separated segments keep the attacker from getting from one machine to all of them.
• Least privilege, meaning minimal privileges: an account with no rights to spare makes escalation harder.
• Detection of lateral movement: watching sign-ins and movement between machines reveals the attack during dwell time, rather than only when the encryption starts.
• Offline or immutable backups: what the attacker can’t encrypt or delete takes away their main source of pressure.

None of those measures stops ransomware on its own. Together they close so many paths that the chain breaks before the encryption starts. That is exactly why we test: to find out which of those paths are still open at your company.

Ransomware gets in by three main routes: phishing, which aims at the person, a vulnerable or forgotten service exposed to the internet, and valid stolen credentials that the attacker simply signs in with. What they have in common is that they are only an entry point. Getting in isn’t the encryption yet, and between the two lies a whole chain of steps.

Yes, because encryption is the last step. Between getting in and that step, the attacker moves through the network and raises privileges, which leaves traces. Detection of lateral movement and of escalation attempts in Active Directory can catch the attack at that stage. That capability is exactly what a red team operation measures, not whether a single vulnerability exists.

A penetration test helps by showing the paths an attacker would use, from the way in through movement across the network to escalation to Domain Admin. Closing those paths breaks the chain earlier. The test is not a guarantee, though: it gives no certainty that ransomware won’t come, but a list of the specific places where your defense is weak and the order in which to fix them.