The Anatomy of a Ransomware Attack: How It Happens and How to Stop It

Ransomware has evolved from a nuisance targeting individual users into a sophisticated, multi-billion-dollar criminal enterprise that can cripple hospitals, municipalities, and Fortune 500 companies alike. Understanding exactly how these attacks unfold (from the first reconnaissance to the final encryption) is the only way to build defenses that actually work. Here's the modern ransomware kill chain, stage by stage, with specific defensive controls mapped to each phase.

The Modern Ransomware Kill Chain

Unlike the opportunistic ransomware campaigns of the early 2010s, today’s attacks are deliberate, human-operated affairs. Threat actors spend days or weeks inside a network before deploying a single encrypted file. The kill chain typically follows seven stages.

1. Initial Access

Every ransomware attack begins with gaining a foothold. The most common initial access vectors include:

• Phishing emails: Spear-phishing campaigns with weaponized attachments or credential-harvesting links remain the number-one entry point. Groups like FIN7 and Conti have been known to craft highly targeted emails impersonating vendors, HR departments, or IT support.
• RDP exploitation: Exposed Remote Desktop Protocol endpoints with weak or reused credentials are a gift to attackers. Shodan and similar scanning tools make it trivial to find open RDP ports across the internet.
• Vulnerability exploitation: Unpatched edge devices and applications provide another popular gateway. The Cl0p group leveraged MOVEit Transfer zero-days in 2023 to compromise hundreds of organizations. Similarly, ProxyLogon and ProxyShell vulnerabilities in Exchange servers have been weaponized at scale.
• Stolen credentials from infostealers: Malware-as-a-service platforms like RedLine and Raccoon harvest browser-stored passwords and session cookies, which are then sold on underground markets and used for initial access.

2. Establishing Persistence

Once inside, attackers ensure they can maintain access even if the initial entry point is discovered and closed. Common persistence techniques include creating new local or domain accounts, installing remote access tools like AnyDesk or ScreenConnect, planting web shells on internal servers, and modifying scheduled tasks or registry run keys. Attackers often set up multiple persistence mechanisms simultaneously so that removing one does not evict them.

3. Privilege Escalation

Ransomware operators need administrative or domain-level credentials to deploy their payload across the network. Techniques such as Pass-the-Hash, Kerberoasting, and exploiting misconfigured service accounts allow attackers to escalate from a standard user to domain administrator. Tools like Mimikatz dump credentials directly from memory, while BloodHound maps Active Directory attack paths to reveal the fastest route to domain dominance.

4. Lateral Movement

With elevated credentials in hand, attackers pivot across the network using legitimate administration tools. Cobalt Strike beacons, PsExec, WinRM, and abused admin shares (C$, ADMIN$) allow lateral movement that blends with normal IT traffic. Attackers enumerate the network to locate domain controllers, backup servers, file shares, and databases: anything of value that can be encrypted or exfiltrated.

5. Data Exfiltration

The double extortion model has become standard practice. Before encrypting anything, attackers exfiltrate sensitive data to external servers using tools like Rclone, 7-Zip archives uploaded to cloud storage, or custom exfiltration channels disguised as legitimate HTTPS traffic. The stolen data becomes leverage: even if the victim has backups and refuses to pay for decryption, the threat of publishing confidential data creates additional pressure. Groups like LockBit and ALPHV/BlackCat operate dedicated leak sites where stolen data is published in stages.

6. Encryption Deployment

The final payload is typically deployed during off-hours (late nights, weekends, or holidays) when IT staff response is slowest. Ransomware binaries are often pushed via Group Policy Objects, PsExec, or legitimate software deployment tools that attackers have already compromised. Modern ransomware employs intermittent encryption (encrypting only portions of each file) to speed up the process while still rendering files unusable.

7. Ransom Demand

The ransom note appears on every encrypted system, directing victims to a Tor-based negotiation portal. Demands range from tens of thousands to tens of millions of dollars, and attackers now routinely set dual deadlines: one for the decryption key and a separate, earlier deadline for preventing data publication.

Defensive Controls Mapped to Each Kill Chain Stage

The best defense is not a single silver bullet but layered controls that raise the cost of attack at every stage of the kill chain.

Stopping Initial Access

Deploy an email security gateway with sandboxing and URL rewriting to neutralize phishing payloads. Enforce multi-factor authentication on every external-facing service: especially RDP, VPN, and cloud email. Maintain a rigorous patch management program with a 72-hour SLA for critical vulnerabilities on internet-facing systems. Disable or restrict RDP access through a VPN with MFA rather than exposing it directly.

Preventing Persistence

Implement endpoint detection and response (EDR) across all workstations and servers. EDR solutions can detect unauthorized remote access tools, suspicious registry modifications, and new account creation. Conduct regular audits of local administrator group memberships and disable unused accounts.

Blocking Privilege Escalation

Deploy a privileged access management (PAM) solution that rotates credentials and isolates privileged sessions. Implement Microsoft’s Local Administrator Password Solution (LAPS) to ensure every machine has a unique local admin password. Monitor for Kerberoasting attempts by alerting on excessive TGS requests for service accounts.

Limiting Lateral Movement

Network segmentation is critical. Implement micro-segmentation so that a compromised workstation cannot directly reach domain controllers, backup infrastructure, or critical databases. Enforce the principle of least privilege for all accounts. Monitor for anomalous use of PsExec, WinRM, and SMB traffic between workstations.

Detecting Data Exfiltration

Deploy a data loss prevention (DLP) solution and monitor for large outbound data transfers, especially to unfamiliar external IPs or cloud storage providers. A CASB (Cloud Access Security Broker) can detect and block unauthorized uploads to sanctioned and unsanctioned cloud services.

Surviving Encryption

Maintain immutable, air-gapped backups that cannot be deleted or encrypted by an attacker with domain credentials. Test backup restoration regularly: a backup you cannot restore is worthless. Ensure backup infrastructure is on a separate network segment with separate credentials.

Key Indicators of Compromise

Watch for these warning signs that a ransomware attack may already be in progress:

• Unusual account lockouts or password reset requests
• Unexpected RDP connections from internal workstations to servers
• Large volumes of SMB traffic between endpoints
• Cobalt Strike beacon callbacks over HTTPS on non-standard ports
• PowerShell execution with encoded or obfuscated commands
• Scheduled tasks or services created by non-administrative users
• Disabling or tampering of security tools (EDR, antivirus, Windows Defender)
• Large outbound data transfers to cloud storage or foreign IPs
• Enumeration commands (nltest, net group, dsquery) executed on endpoints

Practical Checklist: What to Do Right Now

Use this checklist to assess your organization’s ransomware readiness:

• MFA enabled on all remote access points (VPN, RDP, email, SaaS)
• Email security gateway with sandboxing and attachment filtering deployed
• Critical vulnerabilities on internet-facing systems patched within 72 hours
• EDR deployed on 100% of endpoints with 24/7 monitoring
• Network segmentation separating workstations from critical infrastructure
• Privileged access management in place with credential rotation
• Immutable backups configured and tested quarterly
• Incident response plan documented, with contacts current and tested
• Regular phishing simulations and security awareness training
• DNS and network traffic monitoring for exfiltration indicators

Ransomware is not a question of “if” but “when.” Organizations that map their defenses to the kill chain (and test those defenses regularly) drastically reduce both the likelihood and the impact of a successful attack. If your organization has not conducted a ransomware readiness assessment in the last twelve months, now is the time.