Ransomware usually reaches more than one business computer because an attacker expands access after getting a foothold—not because an infected file automatically jumps to every nearby device. The attacker may discover systems and accounts, steal credentials, use remote-management tools, and then launch encryption on machines they can reach. The route varies by incident, and not every operation uses every step.
Ransomware spreads through access and control
A business network is a collection of connected devices, accounts, services, and permissions. If an attacker takes control of one computer or account, the next question is what that foothold can reach. Shared administrator credentials, broadly available remote access, and weak separation between systems can give an intruder routes from an initial device to other parts of the organization.
As an Amazon Associate I earn from qualifying purchases.
That is different from saying ransomware always behaves like a computer virus that copies itself automatically from one machine to another. In many incidents, people operating the attack use credentials, remote sessions, scripts, or existing management tools to move through the environment. Once they have enough access, they can deploy ransomware to multiple reachable systems. Some attacks may use automated techniques, but no single propagation method describes every incident.
Recommended Free Tools
The distinction matters for prevention. Blocking one malicious file is not enough if an attacker can sign in with a valid account and administer other computers. Businesses need controls that reduce the chance of entry, restrict what a compromised account can reach, reveal suspicious activity, and preserve a separate path to recovery.
#1 Best Overall
- POWERFUL SECURITY KEY: The YubiKey 5C NFC is the most versatile physical passkey, protecting your digital life from phishing attacks. It ensures only you can access your accounts
- WORKS WITH 1000+ ACCOUNTS: Compatible with popular accounts like Google, Microsoft, and Apple. A single YubiKey 5C NFC secures 100+ of your favorite accounts, including email, password managers, and more
- FAST & CONVENIENT LOGIN: Plug in your YubiKey 5C NFC via USB and tap it, or tap it against your phone (NFC), to authenticate. No batteries, no internet connection, and no extra fees required
- MOST SECURE PASSKEY: Supports FIDO2/WebAuthn, FIDO U2F, Yubico OTP, OATH-TOTP/HOTP, Smart card (PIV), and OpenPGP. That means it’s versatile, working almost anywhere you need it
- PRIMARY & SPARE KEYS: Just like having a spare house key, we recommend buying two YubiKeys - one for daily use and one as a spare. That way you’ll never get locked out of your accounts
How an attack can move from one foothold to widespread encryption
1. The attacker gets an initial foothold
Initial access can come from different routes. The CISA #StopRansomware Guide, identified by CISA as the September 2023 guide, covers phishing, compromised credentials, vulnerabilities and misconfigurations in internet-facing systems, advanced social engineering, precursor malware, and third parties or managed service providers. These are distinct possibilities, not a checklist that every incident follows.
Exposed remote services are one important route. CISA and its partners warn that “Threat actors often gain initial access to a network through exposed and poorly secured remote services, and later traverse the network using the native Windows RDP client.” Here, RDP means Remote Desktop Protocol: a way to sign in to and control a computer remotely. The warning explains how remote access can feature both at entry and during later movement; it does not mean every ransomware incident starts with RDP.
A Microsoft Incident Response case study, last updated October 16, 2024, describes one particular incident in which an internet-exposed RDP service on TCP port 3389 was targeted with brute-force authentication. That is a case-specific detail, not evidence that every exposed service uses that port or that brute-force login is the usual route. Phishing, stolen passwords, and vulnerable internet-facing software can present different entry problems and require complementary safeguards.
What’s actually slowing this PC down?
Pick the symptom - the matching free tool is one click away.
2. The attacker learns what the foothold can reach
After gaining access, an attacker may examine the network before making a visible move. Discovery can include identifying IP addresses, open ports, devices, user and group accounts, permissions, and important services. The goal is to understand where valuable data and control points are, and which accounts or systems could help reach them.
Rank #2
- POWERFUL SECURITY KEY: The Security Key C NFC is the essential physical passkey for protecting your digital life from phishing attacks. It ensures only you can access your accounts.
- WORKS WITH 1000+ ACCOUNTS: Compatible with Google, Microsoft, and Apple. A single Security Key C NFC secures 100 of your favorite accounts, including email, password managers, and more.
- FAST & CONVENIENT LOGIN: Plug in your Security Key C NFC via USB-C and tap it, or tap it against your phone (NFC) to authenticate. No batteries, no internet connection, and no extra fees required.
- TRUSTED PASSKEY TECHNOLOGY: Uses the latest passkey standards (FIDO2/WebAuthn & FIDO U2F) but does not support One-Time Passwords. For complex needs, check out the YubiKey 5 Series.
- BUILT TO LAST: Made from tough, waterproof, and crush-resistant materials. Manufactured in Sweden and programmed in the USA with the highest security standards.
In Microsoft’s case study, the actor looked for domain controllers, backup servers, databases, and cloud resources. A domain controller helps manage identities and access in a Windows environment; access to one can be especially consequential because it can affect many accounts and computers. The case illustrates why a single endpoint should not be treated as the only asset at risk after a breach.
3. Credentials can turn one compromise into many logins
An attacker who obtains usable credentials may be able to sign in to additional systems without exploiting each computer separately. Microsoft documents an actor harvesting password hashes and searching for plaintext credentials in the incident described in its case study, then using credentials to access more systems. A password hash is a transformed representation used in authentication; it is not the same thing as a plaintext password, but attackers may try to use or crack stolen authentication material.
This is why the reach of an account matters as much as the security of the device where it was first used. A normal user account should not have administrative rights across a fleet of computers simply for convenience. Privileged accounts deserve stronger protection and should be kept separate from routine browsing and email activity, so compromise of an everyday account does not automatically grant broad administrative control.
4. Remote tools and sessions can carry the intrusion across the network
With credentials or other access in hand, an attacker may use Remote Desktop, scripts, remote-management software, or administrative systems to reach more machines. These tools exist for legitimate IT work, so their presence alone does not prove an attack. But use from an unusual account, at an unusual time, or toward an unexpected set of devices can be a useful warning for security staff.
Rank #3
- POWERFUL SECURITY KEY: The YubiKey 5 NFC is the most versatile physical passkey, protecting your digital life from phishing attacks. It ensures only you can access your accounts
- WORKS WITH 1000+ ACCOUNTS: Compatible with popular accounts like Google, Microsoft, and Apple. A single YubiKey 5 NFC secures 100+ of your favorite accounts, including email, password managers, and more
- FAST & CONVENIENT LOGIN: Plug in your YubiKey 5 NFC via USB and tap it, or tap it against your phone (NFC), to authenticate. No batteries, no internet connection, and no extra fees required
- MOST SECURE PASSKEY: Supports FIDO2/WebAuthn, FIDO U2F, Yubico OTP, OATH-TOTP/HOTP, Smart card (PIV), and OpenPGP. That means it’s versatile, working almost anywhere you need it
- PRIMARY & SPARE KEYS: Just like having a spare house key, we recommend buying two YubiKeys - one for daily use and one as a spare. That way you’ll never get locked out of your accounts
Microsoft’s incident account describes credential harvesting, backdoor persistence, and movement through remote desktop sessions. Persistence means retaining a way to regain access after an initial login or foothold is disrupted. CISA’s guidance emphasizes segmentation as a way to contain intrusions and limit lateral movement—the term for moving from one system to another inside an environment.
5. Ransomware is deployed to systems the attacker can control
When attackers have sufficient privileges and routes to other endpoints, they can launch ransomware on multiple machines. This can be done by an operator issuing commands or by using automation; it is not necessary for the ransomware file to independently infect every device in the manner of a self-spreading worm.
In the Microsoft case, PsExec was used to launch an interactive PowerShell script from remote shares. Microsoft also notes that operators may use existing applications or features, including PsExec and Group Policy, to reach endpoints. Those are documented examples from the case study and Microsoft’s discussion—not a universal recipe. Legitimate tools can be abused precisely because administrators already use them, which makes restricting and monitoring their use important.
Free tools Windows power users keep installed
One-click scans. No signup required.
6. The impact may extend beyond encrypted files
Microsoft’s case describes impact actions such as stopping services, deleting shadow copies or backups, and encrypting files. These actions can make it harder to operate normally or restore data, but they should be understood as behaviors documented in that account, not steps every ransomware strain performs.
Rank #4
- POWERFUL SECURITY KEY: The Security Key NFC is the essential physical passkey for protecting your digital life from phishing attacks. It ensures only you can access your accounts.
- WORKS WITH 1000+ ACCOUNTS: Compatible with Google, Microsoft, and Apple. A single Security Key NFC secures 100 of your favorite accounts, including email, password managers, and more.
- FAST & CONVENIENT LOGIN: Plug in your Security Key NFC via USB-A and tap it, or tap it against your phone (NFC) to authenticate. No batteries, no internet connection, and no extra fees required.
- TRUSTED PASSKEY TECHNOLOGY: Uses the latest passkey standards (FIDO2/WebAuthn & FIDO U2F) but does not support One-Time Passwords. For complex needs, check out the YubiKey 5 Series.
- BUILT TO LAST: Made from tough, waterproof, and crush-resistant materials. Manufactured in Sweden and programmed in the USA with the highest security standards.
Some ransomware operations also steal data and threaten to publish it. In that kind of extortion, usable backups may help restore systems but cannot by themselves undo disclosure or remove the pressure created by a threat to release copied information. CISA’s guide addresses ransomware and data extortion, so planning should consider both service disruption and potential data exposure.
Why flat networks and shared administration increase exposure
Network segmentation divides an environment into areas with controlled routes between them. Without meaningful boundaries, a compromised device may have network paths to systems that do not need to communicate with it. If one account or management tool also has broad privileges, that can make more of those paths usable to an intruder.
CISA says, “Network segmentation can help contain the impact of any intrusion affecting your organization and prevent or limit lateral movement on the part of malicious actors.” The goal is to make a foothold less useful: a user workstation should not automatically have a route to every server, backup system, or operational technology environment. Segmentation is not a guarantee. Broad permissions, overly permissive network rules, or cross-segment management connections can weaken the boundary.
Shared administration creates a related risk. If the same powerful account can sign in everywhere, or remote-management tools are reachable throughout the network, control of that account or tool may open many doors. Limiting administrative access and the systems that can initiate remote management reduces the number of routes an attacker can exploit.
Best Value
- FIDO2 & Passkey Ready: Business-ready and FIDO2 L1 certified. This key is supported by major management suites and is ideal for both individual and enterprise deployment. Works seamlessly with Gmail, Facebook, GitHub, Dropbox, Coinbase, and more.
- Universal Connectivity (USB-A ): Features a built-in USB-A connector—simply unfold the key and plug it into your compatible PC or laptop for seamless authentication on the go.
- Dedicated Manager App: Use the Thetis Manager App for the initial hardware PIN setup. Setting the PIN on the device first ensures a smooth registration process. Once the PIN is configured, you can begin registering the key across your favorite FIDO2-compatible online services.
- Ultra-Durable & Portable: Featuring a rotating metal cover, this key is water, crush, and tamper-resistant. It fits easily on a keychain and requires no batteries or network connectivity.
- Check FIDO2 compatibility before purchase - Known limitations: ID Austria is not supported (requires FIDO2 Level 2). Windows Hello login only works with Windows Enterprise editions that support Entra ID, and NFC is NOT supported.
Controls that interrupt the chain
These measures address different points in an attack. They work best as layers: preventing entry cannot guarantee no breach, and backups do not stop lateral movement, but together they can reduce both the chance and the impact of an intrusion.
| Control point | What to do | What it helps address |
|---|---|---|
| Initial access | Patch internet-facing software promptly, scan for exposed assets, remove services that are not needed, and avoid exposing RDP directly to the internet. Constrain required remote access and protect it with MFA. | Reduces opportunities to enter through exposed services, vulnerable systems, or compromised logins. |
| Identity and privilege | Use phishing-resistant MFA, especially for email, VPN, privileged accounts, and access to critical systems. Separate administrator accounts from ordinary user accounts and apply least privilege. | Makes account compromise harder to turn into broad administrative access. |
| Network routes | Segment the network, separate business IT from operational technology where applicable, and restrict remote-management tools to approved uses. | Limits which systems a foothold can reach and how far an intrusion can move. |
| Detection | Retain and centralize logs, monitor for anomalous logins and privilege changes, and use endpoint monitoring to investigate unusual remote execution. | Gives defenders a chance to identify suspicious activity as access expands or commands run remotely. |
| Recovery | Keep backups offline and encrypted, test restoration regularly, and, where feasible, prevent ordinary compromised accounts from accessing backup systems. | Preserves a recovery option when production systems or accessible backups are affected. |
How to review your defenses in practical order
- Find the doors into the network. Inventory internet-facing systems and remote-access services. Remove those that are unnecessary, patch exposed software, and check that remote access is constrained rather than directly open to the internet.
- Check who can sign in and what they can do. Require phishing-resistant MFA for high-impact services and privileged access. Review administrator accounts, remove rights that are not needed, and avoid using privileged accounts for ordinary work.
- Map routes between systems. Identify which workstations, servers, backup services, and operational technology systems can communicate. Restrict those connections to what business operations require, and scrutinize cross-segment access used for management.
- Make remote administration visible and controlled. Define which tools and accounts are approved for remote management. Review their logs and investigate unexpected remote sessions, account use, privilege changes, or remote execution.
- Prove that recovery works. Keep copies offline and encrypted, protect them from ordinary accounts, and periodically test whether the organization can restore data and systems from them.
This sequence starts with reachable entry points and identity because those can create the foothold and permissions used for movement. It then addresses internal routes, visibility, and recovery. The measures are complementary rather than competing alternatives: a good backup does not make an exposed remote service safe, and MFA does not substitute for segmentation.
What the available evidence does—and does not—show
The sources here establish several plausible and documented ways ransomware operators can gain access and move through business environments. CISA’s September 2023 joint guide covers multiple initial-access and prevention categories; its LockBit advisory, published in 2023, and Play ransomware advisory, published in 2023 and noted as updated June 4, 2025, provide group-specific access and mitigation context. These advisories should not be read as descriptions of every ransomware operation.
Outdated Drivers Are Slowing You Down
One free scan finds every outdated or missing driver and matches the right update for your exact hardware.Free scan · exact hardware matchPC Slower Than It Used to Be?
A free scan shows the junk files, broken settings and background clutter dragging Windows down - then fixes them in one click.Free scan · Windows 10 & 11Microsoft’s case study is a detailed account of one incident, not a survey of how frequently each technique is used. The cited material does not establish a comparable 2026 ranking of initial-access or lateral-movement methods, so it would be misleading to assign percentages or call one route universally dominant. The useful conclusion for a business is operational: protect more than the first computer, because an attacker may use access, credentials, and remote tools to reach a wider set of systems.
Quick Recap
Product prices and availability are accurate as of the date/time indicated and are subject to change. Any price and availability information displayed on Amazon at the time of purchase will apply.
