Ransomware: attack and defences

Attacker

The attacker - often part of a larger criminal group - operates remotely. Their goal is to encrypt and steal the data of organizations and individuals. If they succeed, they demand a ransom (usually in crypto-currency): the target pays either to recover their data or to stop it being made public.

Email attachment

A dropper is a small program built to install the ransomware payload once it reaches a target machine. Here, it arrives disguised as a legitimate attachment - an invoice, a résumé, a shipping notice - relying on the recipient to open it themselves, before installing the payload directly (single-stage) or fetching it from the attacker's infrastructure (two-stage).

Malicious link

A dropper is a small program built to install the ransomware payload once it reaches a target machine. Here, it's delivered via a link to a compromised or look-alike site rather than an attachment: visiting it silently pulls down the dropper, which then installs the payload directly or fetches it in a second stage.

Download wrapper

A dropper is a small program built to install the ransomware payload once it reaches a target machine. Here, it hides inside a legitimate-looking download - a cracked application, a fake software update - so the malware installs alongside whatever the target thought they were getting.

First protection barrier

At this stage, user education, inbound email inspection, URL filtering, and endpoint protection form the most effective barrier to an attack. Privileged endpoint management (PEM), built on zero-trust principles, adds another layer: users run without local admin rights by default, with privilege escalation granted per task, under policy - so a malicious download that slips through has far less power to install anything.

Infection

The dropper has done its job and the ransomware payload executes on the first machine. It embeds itself so it survives a reboot, contacts the attackers' infrastructure for instructions, and starts scanning for credentials, data, and connected drives. The encryption everyone associates with ransomware comes much later - first, it needs to spread.

First user

The most common entry point to an attack is the people in the business. Even with good training, an attack can be sophisticated enough to fool anyone; some do not even need user action. Once the ransomware infects the workstation, it can lie in wait for more valuable content - sometimes for weeks or months - before the encryption begins.

Credential and data exfiltration: user level

Once the workstation is infected, the ransomware quietly harvests the user’s credentials and data. The stolen credentials become gateways for the next stage of the attack, while valuable files - confidential or copyrighted information - are exfiltrated so the attackers can threaten to make them public.

Second protection barrier

Once a workstation is compromised, containing the damage means limiting what that foothold can reach. Least privilege, MFA, and network segmentation stop one infected machine becoming a gateway to the business, while privileged access management (PAM) keeps admin credentials out of reach of any stolen account. Continuous monitoring for credential misuse and lateral movement catches an attacker before real damage occurs.

Critical jump

Armed with stolen credentials, the attacker moves beyond the first infected workstation. This is the critical jump from a single compromised machine to the wider network - probing for weakly protected accounts and systems that grant access to shared resources, servers, and eventually the infrastructure that runs the business.

Non-human identity

A non-human identity holds the same kind of elevated rights as any privileged account - the power to reconfigure systems, disable defences, and reach resources most people never could - but without a person behind it: a service account running unattended automation, or increasingly an AI agent acting on its own initiative. Both often hold broad, long-lived permissions, with no one watching for unusual behaviour in real time.

Privileged users

Privileged users hold elevated rights that let them reconfigure systems, disable defences, and reach resources most people never could - making their accounts some of the most valuable credentials on the network. IT administrators are the most obvious example, but the same standing access often extends to executives, developers, and anyone else granted elevated rights.

Shared drives

Shared network drives are a high-value target: they concentrate the files many people rely on into one place. Once reached, the attacker can encrypt or exfiltrate entire folders of shared documents in a single move, multiplying the damage far beyond what any one user's files would cause.

Credential and data exfiltration: privileged level

With privileged access secured, the attacker's reach and reward both grow. Sensitive data - financial records, intellectual property, personal information - and higher-level credentials are now in scope, raising the stakes for the ransom demand and the threat of exposure.

Third protection barrier

By this stage, the attacker holds privileged credentials and is moving through core infrastructure. The priority is limiting the blast radius: tiered administration, endpoint detection and response (EDR), and PAM together control who can reach domain controllers, hypervisors, and backups. Privileged process automation (PPA) closes the loop, running admin tasks as vaulted, automated processes so credentials never appear on a workstation for malware to harvest.

Lateral movement

Using the credentials it has already stolen, the ransomware fans out across the network - probing servers, virtualization hosts, and domain infrastructure for the next weak point. Each new system it reaches becomes a further foothold, bringing the attacker closer to the infrastructure that keeps the business running.

Domain controller

The domain controller manages identity and access for the entire network. Compromising it hands the attacker the ability to create accounts, reset passwords, and grant themselves access to virtually anything - turning a single breach into control of the whole environment.

Hypervisor

Many organizations run their servers as virtual machines on a shared hypervisor. Gaining control of it lets the attacker access, encrypt, or destroy every virtual machine it hosts at once - an efficient way to cause maximum damage from a single compromise.

Online backups

Backups are the safety net an organization relies on to recover without paying. If those backups are reachable from the network - and many are, for convenience - the attacker will target them directly, deleting or encrypting them to remove the victim's ability to restore data independently.

Credential and data exfiltration: domain level

With domain-level access, the attacker can now harvest credentials and sensitive files across the whole organization, not just one department. This is where the incident stops being a single-workstation problem and becomes a full breach of the organization's identity and data.

Fourth protection barrier

The last line of defence is making recovery possible even after everything else fails. That means immutable or air-gapped backups - the 3-2-1 principle of multiple copies, on different media, with one copy off-network - plus regularly tested restores and retention that outlasts an attacker who may have lurked for months. Get it right, and there's always a clean copy the attacker can never touch. Get it wrong, and the last door is already open.

Final encryption

Before triggering the final encryption, the ransomware makes one last sweep for any backup it can still reach - including ones assumed to be safe - removing the victim's remaining options for recovery. Then the payload fires on every machine it has reached: files are encrypted with strong cryptography, and a ransom note explains how to pay for a decryption key - or to stop the stolen data being published.

Offline backups

The offline backups are the last resource - the one copy the attacker cannot reach. They don't need to: for weeks, these media have archived data from systems already infected. The compromise rode in through the backup process itself, and the last clean copy has aged out of rotation. When the final encryption fires, nothing is left to restore - only the choice to pay the ransom, with no guarantees, or start over from nothing.