Inside a Modern Ransomware Attack

Modern ransomware is not a virus. It is a business process. The attackers run it like a company, with departments, SLAs, and customer support for the victims. Understanding how the attack actually unfolds is the best way to figure out where to defend against it.

Here is the lifecycle of a modern ransomware attack, in plain English, with the defensive lessons at each step.

Phase 1: Initial access

Every attack starts with a foothold. The most common footholds in 2026:

• Stolen credentials from a phishing email, a credential dump, or a third-party breach.
• Exposed remote services like VPN, RDP, or Citrix without MFA.
• Drive-by compromise of an unpatched public-facing system.
• Supply chain via a trusted vendor or managed service provider.

Defensive lesson: The single highest-leverage control is MFA on every external login. The second is patching internet-facing systems within a week of a critical CVE. Together, they close the majority of initial access paths.

Phase 2: Foothold and persistence

Once in, the attacker needs to stay in. They will:

• Disable or tamper with security software.
• Create new accounts or abuse legitimate ones.
• Establish persistent access via scheduled tasks, services, or VPN connections.
• Hide in tools the security team uses every day: PowerShell, WMI, Remote Desktop, system management tools.

This is called “living off the land.” The attacker is not running custom malware. They are using the same tools your IT team uses. It makes them very hard to detect.

Defensive lesson: Centralize logs. Alert on the things that should not happen: new admin accounts, disabled security tools, scheduled tasks created at 3 AM, PowerShell scripts reaching out to the internet.

Phase 3: Privilege escalation

The attacker started as a low-privilege user. Now they want to be domain admin or its cloud equivalent. They will:

• Dump credentials from memory using tools like Mimikatz.
• Look for passwords stored in files, scripts, and configuration management systems.
• Exploit misconfigured service accounts with more access than they need.
• Abuse identity providers and SSO to move across SaaS applications.

Defensive lesson: Least privilege. Service accounts should have only the access they need. Domain admin should be used by humans rarely, ideally from a hardened, separate system. Multi-factor on every privileged account.

Phase 4: Lateral movement

With admin access, the attacker explores. They will:

• Enumerate the network: what systems, what data, what access.
• Move through file shares, RDP, and SSO to find what they want.
• Identify the systems that hold the data they will steal.
• Stage data for exfiltration in places it does not normally live.

Defensive lesson: Internal segmentation. One compromised workstation should not equal access to every file share. The blast radius matters more than the breach itself.

Phase 5: Data theft

Modern ransomware operations exfiltrate data before they encrypt anything. The encryption is the leverage. The data theft is the threat.

Attackers will:

• Compress and encrypt stolen data so it is harder to detect in transit.
• Use legitimate cloud storage (Mega, Dropbox, Azure Blob) to host the exfil.
• Time the exfiltration to off-hours when monitoring is light.
• Take screenshots of sensitive systems to prove they had access.

Defensive lesson: Watch for unusual outbound traffic. Alert on large uploads to consumer cloud services. Use DLP tools if you can. Even simple egress monitoring catches a lot of this.

Phase 6: Encryption

Finally, the part that makes the news. The attacker:

• Deploys ransomware across as many systems as possible, often in parallel.
• Targets backups first, so you cannot recover without paying.
• Renames files, deletes shadow copies, disables recovery options.
• Leaves a ransom note with payment instructions and a “support” channel.

Defensive lesson: Immutable, offline, tested backups. The attackers know you have backups. They are counting on those backups being reachable from your network, soft, or untested. A backup that is offline and that you have actually restored from is the difference between a bad week and a company-ending event.

Phase 7: Extortion

The attackers run a “negotiation” with the victim. They:

• Demand payment, usually in cryptocurrency, for the decryption key.
• Threaten to publish the stolen data on a leak site if you do not pay.
• Pressure you with countdown timers and threats to contact customers and press.
• Sometimes offer to “audit” your security and sell you a remediation package.

There is no good answer here. Law enforcement generally advises against paying. Some victims pay because they have no backups. The attackers are well aware of this asymmetry.

Defensive lesson: Have a plan before the attack. Know who you call: legal, law enforcement, your cyber insurance carrier, your incident response firm. Have the conversation now, not at 2 AM on a Saturday while your entire company is offline.

The defensive takeaway

You cannot stop a determined attacker from trying. You can make the attempt expensive, slow, and likely to fail. The companies that survive ransomware are the ones that:

• Have MFA on every external login.
• Patch quickly.
• Segment their internal network.
• Centralize logs and watch them.
• Have offline, tested backups.
• Have an incident response plan they have actually rehearsed.

None of that is exciting. All of it works. The attackers are betting you have not done the boring stuff. Make sure you have.