A ransomware incident rarely begins with a ransom note. By the time files start encrypting, the attacker has often been inside the network for days, mapping shares, collecting credentials and copying data out. The note is the last step of a longer process, and that process has several points where a defender can cut it short.
Ransomware Needs a Chain, Not a Miracle
Ransomware crews are not looking for the hardest target in your industry. They are looking for the one that fails somewhere in the middle of a familiar sequence: get in, get rights, get data, get paid. Each stage hands the attacker something the next stage depends on — a session, a credential, a privilege level, a copy of your files.
That dependency cuts both ways. You do not have to stop every technique. You only need one stage to fail reliably, and the operation usually stalls. Many crews simply move to a softer target rather than fight a well-instrumented network.
Stage 1: Initial Access
Most intrusions still start with a person doing something ordinary: opening a message, clicking a link, approving a login prompt. A typical phishing chain looks like this. An email arrives that looks like a document share, an invoice, or a voicemail notification. The link leads to a convincing copy of a Microsoft 365 or VPN login page. The password is captured, and if the account has weak multi-factor authentication, the attacker is inside before the employee has finished their coffee.
The less glamorous entries matter just as much:
- A remote desktop or VPN service reachable from the internet with no MFA.
- An unpatched firewall, VPN appliance or email gateway — edge devices are popular precisely because they sit outside the protections you apply to endpoints.
- Malicious search ads pointing to fake installers for common business tools.
- Callback phishing, where a phone number in the email leads to a live "helpdesk" that talks a user through installing remote access software.
- A contractor account that was never disabled after the project ended.
What a real phishing email looks like
Rarely dramatic. No threats, no urgency about a bank account. Instead: a short note that a document requires a signature, sent from a domain one character different from a supplier's real one. The tell is usually the link target, not the wording. Train staff to hover, not to guess.
Stage 2: Execution and Foothold
Once a link is clicked or a session is stolen, the attacker needs persistence. The first payload is small — a script, an installer, a compressed archive. From there, the work often uses tools already present on the machine: PowerShell, mshta, rundll32, scheduled tasks, registry Run keys. Nothing exotic, which is exactly why it blends in.
A common pattern is installing legitimate remote monitoring and management software, or a remote access tool the company already licenses. The traffic looks normal because it is normal software used by the wrong person. Signals worth alerting on include a new service appearing on a workstation, PowerShell launching as a child process of Word or Excel, and an outbound connection to a host your endpoint inventory has never seen.
Stage 3: Privilege Escalation and Lateral Movement
One workstation is not a business. The attacker now looks for anything that turns a user account into an administrative one: saved passwords in browsers, credentials left in scripts, a shared local admin password across the fleet, or an IT staff member logged into a helpdesk machine with domain rights.
Credential dumping tools pull hashes and tickets from memory. From there, movement is quiet and unremarkable — SMB file shares, WMI, PsExec, RDP sessions between servers, and the same remote management agents your own team uses. A reliable early warning is authentication behaviour: a single account logging into several machines in an hour, or logins at 3 a.m. from an office that is empty.
Stage 4: Exfiltration Before Encryption
Modern ransomware is usually double extortion: steal first, encrypt second. Data is gathered on a file server or a staging workstation, compressed in bulk, and pushed out — often in chunks small enough to avoid tripping a single large-transfer alert. Cloud sync clients are favourites because outbound traffic to a cloud provider is rarely blocked.
This stage is your last comfortable chance to respond. A sudden spike in outbound data, archive files appearing by the hundreds, or unfamiliar cloud storage software on a server should trigger a human investigation, not a ticket. If you run egress monitoring, this is where it earns its budget.
Stage 5: Encryption and Extortion
Then the preparation gets undone deliberately. Shadow copies are deleted, backup agents are stopped or their service accounts abused, endpoint protection is disabled through legitimate administrative tools, and a policy pushes the encryptor across the estate. Encryption itself is fast — minutes to hours on well-mapped networks — and the note appears last, as a notification, not an attack.
Pressure follows: leaked samples published to prove the theft, calls to executives, sometimes direct contact with customers. Notification duties and insurance obligations vary by jurisdiction and policy. Involve your legal counsel and insurer early rather than improvising under pressure.
Where Defenders Break the Chain
Pick the links you can control, and make them fail loudly.
- Make stolen passwords less useful. Phishing-resistant MFA for administrators, finance and anyone with remote access. Number matching beats push approval.
- Close doors you do not need. No RDP or management interfaces exposed to the internet, patched edge devices, and a reviewed inventory of remote access tools.
- Watch the middle of the chain. New services, new scheduled tasks, bulk archiving and admin tools running outside change windows are all cheap high-value alerts.
- Assume data leaves. Monitor outbound volume and cloud uploads. Know your top ten data stores and who should ever touch them.
- Protect backups like production. Offline or immutable copies, separate credentials, and a restore test you actually run on a schedule.
- Rehearse the first hour. One page: who isolates, who calls counsel and the insurer, who talks to staff, and how you communicate if email is down.
A long attack chain is good news for defenders. It means the intruder must be lucky or unnoticed several times in a row — and you only have to be competent once.