Ransomware is usually a multi-stage intrusion, not a single malicious file. Attackers obtain an entry point, establish control, discover valuable systems, steal credentials, move through the network, copy data out, and only then encrypt systems or threaten publication. The encryption screen is often the most visible moment of a compromise that has already lasted days or weeks.
The ransomware lifecycle at a glance
CISA describes ransomware as malware that encrypts files so devices and the systems that depend on them become unusable. Modern operations commonly add data theft and a publication threat. MITRE ATT&CK separates the activity into tactics such as execution, persistence, discovery, privilege escalation, credential access, lateral movement, collection, command and control, and impact.
As an Amazon Associate I earn from qualifying purchases.
| Stage | What operators do | Typical defensive focus |
|---|---|---|
| Initial access | Enter through phishing, stolen accounts, exposed remote services, vulnerabilities, malware, or a supplier | Phishing-resistant MFA, patching, exposure reduction, third-party access controls |
| Execution, persistence and discovery | Run tools, create a route back in, map hosts, shares, identities, defenses and backups | Endpoint visibility, application control, identity monitoring, secure configuration |
| Privilege and credentials | Steal passwords or tokens and seek administrator or domain-level rights | Least privilege, credential protection, just-in-time administration |
| Lateral movement and preparation | Use remote administration to reach more systems, weaken defenses and stage data | Segmentation, restricted east-west traffic, controlled administration |
| Collection and exfiltration | Package sensitive files and transfer them outside the organization | Egress monitoring, unusual-volume alerts, file-transfer controls |
| Encryption and extortion | Encrypt systems, demand payment, publish stolen data or use data-only pressure | Offline immutable backups, restoration practice, incident response |
The phases overlap. An operator may return to discovery after gaining a new account, and data theft can occur before, during or instead of encryption.
Do these 3 things before closing this tab:
1Repair Windows errors before they cause bigger problems2Fix the driver behind crashes, sound loss and screen glitches3Clear out junk files and repair common Windows errors1. Initial access: how ransomware gets into a network
The first foothold is often an identity, remote service or unpatched internet-facing system rather than a dramatic malware attachment. CISA groups common entry paths into several categories.
#1 Best Overall
Phishing and precursor malware
A deceptive email, document, link or call can deliver a loader, steal a session cookie or persuade a user to approve access. A separate malware infection may provide the remote operator with a foothold that is later handed to a ransomware affiliate.
Compromised or purchased accounts
Criminal groups buy credentials from earlier breaches, steal them with infostealers, or reuse passwords exposed elsewhere. A valid account can look like an ordinary employee or contractor, so authentication alone does not prove that activity is legitimate. Phishing-resistant multifactor authentication, especially hardware-backed security keys, blocks many password-and-session theft paths more effectively than one-time codes.
Exposed remote access
Internet-facing RDP, VPN gateways and other remote services are attractive because they provide a direct route to an internal host. Weak passwords, missing multifactor authentication, old software and misconfigured access policies increase the chance of compromise. Removing unnecessary exposure is safer than assuming a public service will remain unnoticed.
Recommended Free Tools
Exploited vulnerabilities
Attackers scan for unpatched vulnerabilities in perimeter appliances, collaboration servers and other systems reachable from the internet. Emergency patching must include verification that vulnerable services are no longer exposed and review of logs for exploitation that may have occurred before the fix.
Third-party and managed-service-provider access
A supplier with broad remote administration can become the entry point for several customers. Organizations need an inventory of vendor accounts, narrowly scoped permissions, time-limited access and logging that distinguishes supplier activity from internal administration.
2. Execution, persistence and discovery after entry
Once inside, operators usually work interactively rather than immediately launching encryption. They execute commands, establish persistence and build a map of the environment.
Execution and command and control
Execution can use scripts, built-in administrative utilities, remote-management software or a commercial penetration-testing framework. Command-and-control traffic may blend into normal web or DNS activity, making endpoint and network correlation important.
Free tools Windows power users keep installed
One-click scans. No signup required.
Persistence
Persistence gives an intruder a way back after a password reset or reboot. Common opportunities include new accounts, scheduled tasks, remote services, startup mechanisms and stolen authentication tokens. Unexpected changes to these mechanisms deserve investigation even when no files are encrypted.
Discovery
Operators enumerate computers, domains, trusts, shared folders, backup servers, virtualization platforms, security tools and high-value applications. They are looking for the shortest path to broad impact and the data most likely to create leverage. A quiet discovery period can therefore be more significant than a single suspicious executable.
3. Privilege escalation and credential access
Ransomware crews try to turn a low-privilege foothold into administrative or domain-level control. They exploit software weaknesses, misconfigured permissions, exposed secrets and password reuse, then use the resulting credentials across many systems.
Credential theft and valid-account abuse
Credential-dumping tools can extract password material from memory or local stores. Session tokens, browser credentials, service-account keys and cached domain information can be just as useful as a plain password. Review newly created, newly privileged and recently reactivated accounts, and protect administrative credentials from ordinary workstations.
The Tool Desk
Outbyte PC Repair FREEClear out junk files and repair common Windows errorsFree Scan →Outbyte Driver Updater FREEFix the driver behind crashes, sound loss and screen glitchesFind Drivers →Why domain-level access matters
Control of identity infrastructure allows an attacker to authenticate broadly, change group membership, deploy software through policy and disable defenses at scale. Separating workstation, server, backup and domain-administration privileges limits what one stolen identity can do.
4. Lateral movement and preparation for impact
Lateral movement converts one compromised computer into an enterprise-wide incident. Operators use remote services and administrative tools to reach file servers, application hosts, hypervisors and backup infrastructure.
Tools and techniques seen in real intrusions
Observed campaigns have used PsExec, Group Policy, RDP, VPN connections, Cobalt Strike and SystemBC to execute commands or maintain control. The presence of a legitimate administration tool is not proof of compromise; the useful question is whether its user, source host, time and destination fit an approved change.
Disabling defenses and backups
Before encryption, attackers may stop security agents, alter logging, delete volume shadow copies, change backup settings or attack backup-management consoles. Protect backup credentials separately, restrict administrative paths to backup systems and alert when shadow copies or recovery configurations change unexpectedly.
What’s actually slowing this PC down?
Pick the symptom - the matching free tool is one click away.
Segmentation and blast radius
Network segmentation places limits on which systems can communicate. Separating user devices from server networks, production from development, and backup infrastructure from ordinary administration can prevent a compromised workstation from reaching every critical system. Segmentation is most effective when firewall rules deny unnecessary east-west traffic rather than merely documenting network zones.
5. Collection and data exfiltration
In many double-extortion operations, theft happens before encryption. Operators search for finance records, customer information, intellectual property, legal files, credentials and other material that can create pressure even if systems are restored.
How data is staged
Files are often copied into compressed archives or temporary staging locations on an internal host. Large archives, unusual access to many users’ folders, and a new archive utility running under an administrative account can reveal preparation activity.
How data leaves
Investigate abnormal outbound volume, transfers over uncommon destinations, tunneling through common ports and use of Rclone, Rsync, FTP, SFTP or web-based file storage. Attackers may throttle transfers or schedule them outside business hours, so baselines should account for legitimate backup and collaboration traffic.
Outdated Drivers Are Slowing You Down
One free scan finds every outdated or missing driver and matches the right update for your exact hardware.Free scan · exact hardware matchPC Slower Than It Used to Be?
A free scan shows the junk files, broken settings and background clutter dragging Windows down - then fixes them in one click.Free scan · Windows 10 & 11Double extortion and data-only extortion
When attackers both encrypt systems and threaten to publish stolen information, CISA calls the combination “double extortion.” Some groups skip encryption and use data-only extortion: they steal information and demand payment solely to keep it private. Restoring from backups therefore does not by itself remove legal, privacy or notification consequences.
Independent reader supportYour contribution helps us test, update, and keep practical guides available for everyone.6. Encryption, ransom pressure and impact
Encryption is the impact phase, not necessarily the beginning of the attack. Operators may use hybrid cryptography so each file is protected with a fast symmetric key and that key is protected with an asymmetric key. In the Play intrusion described by CISA, files were encrypted with an AES-RSA hybrid scheme and intermittent encryption, which encrypts selected portions of large files to accelerate disruption while leaving them apparently present.
What the victim sees
Systems may become unavailable, filenames may change, ransom notes appear and critical services fail simultaneously. A demand can include payment for a decryptor, a promise not to publish stolen data, or both. Because data may already have been copied, paying or obtaining a decryptor cannot guarantee confidentiality.
The three-phase model
| CISA phase | Operational meaning |
|---|---|
| Initial Access | Obtain the first foothold through an account, service, vulnerability, malware or partner |
| Consolidation and Preparation | Expand access, obtain privileges, move laterally, identify data, weaken defenses and stage theft |
| Impact on Target | Exfiltrate, encrypt, interrupt operations and apply ransom pressure |
What the Play case shows
CISA reports that the Play ransomware operation used valid accounts, exploited public-facing FortiOS and Microsoft Exchange vulnerabilities, and accessed external RDP and VPN services. After entry, operators used Cobalt Strike, SystemBC, PsExec, Mimikatz, WinPEAS and Group Policy to enumerate, obtain credentials, execute and move through the environment. Following exfiltration, they encrypted files with AES-RSA hybrid encryption using intermittent encryption.
The case illustrates why a single indicator is insufficient. A vulnerable edge device explains access, credential dumping explains expansion, administrative tools explain lateral movement, and exfiltration explains why restoration alone cannot settle the incident.
Controls mapped to the attack stages
| Control | Stages covered | Privileges required to deploy | Visibility produced | Blast-radius reduction | Recovery value | Operational cost |
|---|---|---|---|---|---|---|
| Phishing-resistant MFA and security keys | Initial access, credential abuse | Identity-administrator planning and user enrollment | Authentication and enrollment events | High for password-based compromise; limited against an already stolen session | Indirect | Enrollment, replacement and user support |
| Network segmentation | Lateral movement and preparation | Network and application-owner coordination | Allowed and denied east-west connections | High when rules deny unnecessary paths | Indirect | Design, testing and exception management |
| Endpoint detection and response | Execution, persistence, credentials, lateral movement and impact | Endpoint-management rights | Process, command-line, account and host telemetry | Medium to high when staffed and isolated quickly | Supports investigation; does not replace backups | Licensing, deployment, tuning and 24-hour response capacity |
| Offline, encrypted, immutable backups | Impact and recovery | Backup-administrator separation | Backup health and restore-test results | Limits dependence on attacker-controlled systems | High if restores are tested and complete | Storage, retention, isolation and recurring restore exercises |
These controls are complementary. A security key addresses identity, segmentation limits reach, EDR supplies investigative evidence, and immutable backups provide a recovery path. None is a substitute for the others.
What organizations should do before an incident
- Require phishing-resistant MFA for administrators, remote access and other high-value identities.
- Patch and verify internet-facing systems, remove unnecessary RDP exposure and review VPN configuration.
- Inventory third-party accounts, restrict them to approved systems and record every session.
- Apply least privilege and just-in-time administration; separate ordinary and domain-administration workstations.
- Segment user, server, management and backup networks, then test that denied paths are actually blocked.
- Collect endpoint, identity, VPN, firewall and cloud-storage logs in a location attackers cannot alter.
- Alert on unusual outbound volume, new archives, mass file access, shadow-copy deletion and changes to backup settings.
- Maintain backups that are offline, encrypted and immutable, cover the organization’s infrastructure, and are restored regularly in exercises.
If encryption or exfiltration is suspected
- Activate the incident-response plan and record the time, affected accounts, hosts and observed ransom or transfer indicators.
- Isolate affected systems and suspicious remote-access paths without destroying volatile evidence; coordinate containment with qualified responders.
- Protect identity and backup infrastructure first by disabling compromised accounts, rotating exposed secrets and blocking unauthorized administrative routes.
- Preserve endpoint, authentication, network and cloud-storage logs for scoping and possible legal or regulatory action.
- Determine whether data was copied, which systems were encrypted, and whether backups remain trustworthy before beginning restoration.
- Coordinate with law enforcement, legal counsel, privacy officers, insurers and trusted incident responders. Treat any payment decision as a legal, operational and risk decision, not a guaranteed recovery mechanism.
Why the encryption notice is only the visible endpoint
A ransomware event should be investigated as a complete intrusion. The initial account or vulnerability, persistence mechanism, privilege escalation, lateral paths, stolen data and backup changes all matter. Finding and closing only the encryptor can leave an attacker’s access intact and allow a second impact event.
Quick Recap
Product prices and availability are accurate as of the date/time indicated and are subject to change. Any price and availability information displayed on Amazon at the time of purchase will apply.
Quick wins for a faster PC:
Repair Windows errors before they cause bigger problemsFix Now →Fix the driver behind crashes, sound loss and screen glitchesFind Drivers →
