Ransomware: Anatomy of an Attack and How to Survive One

Ransomware is no longer a virus that locks your files. It's an industry with a supply chain: brokers who sell network access, developers who lease the malware, affiliates who run the intrusion, negotiators, money launderers and leak-site operators. A typical attack now unfolds over days or weeks of quiet work inside the network before anything is encrypted — which means there are days or weeks in which it can be stopped. Understanding the sequence is how you find those chances.

The business model

Ransomware-as-a-service (RaaS) groups build the malware, the leak site and the payment infrastructure, and recruit affiliates who carry out attacks for a share of the ransom — typically 70–80%. Initial access brokers sell them footholds: stolen VPN credentials, exposed remote desktop, unpatched appliances. The groups rebrand after law-enforcement disruptions (LockBit, ALPHV/BlackCat and others have been taken down and re-formed), and the affiliates simply move to the next platform. Ransom demands run from tens of thousands of dollars for small businesses to tens of millions for large ones; the single largest known payment, in 2024, was $75 million.

Anatomy of a modern attack

1. Initial access. Phishing remains common, but the fastest-growing routes are exploited vulnerabilities in internet-facing systems — VPN concentrators, file-transfer appliances, firewalls — and stolen credentials bought from brokers or harvested by infostealer malware. Remote desktop exposed to the internet without MFA is still a reliable way in.
2. Establish and escalate. The attacker installs remote-access tooling, dumps credentials, and works toward domain administrator. Legitimate admin tools are used to blend in.
3. Move laterally and reconnoitre. Find the file servers, the backups, the virtualisation hosts and the crown-jewel data. Identify cyber-insurance documents to calibrate the demand.
4. Exfiltrate. Copy sensitive data out — often hundreds of gigabytes — over days. This is double extortion: pay or the data is published. Some groups now skip encryption entirely and extort on the data alone.
5. Destroy recovery options. Delete backups, shadow copies and snapshots; encrypt the backup server first.
6. Encrypt and demand. Deployed across the estate simultaneously, frequently at the hypervisor level so hundreds of VMs go down at once, often on a Friday night or a holiday.

Dwell times have shortened from weeks to a few days as attackers automate, but steps 2–5 still leave traces. That's the detection window.

Who gets hit

Everyone, but with patterns. Healthcare, education, local government and manufacturing are over-represented because they combine critical operations with thin security budgets. Small and mid-sized businesses are attacked far more often than headlines suggest because they're easier. Attacks on managed service providers and software suppliers cascade to all their customers at once. And the consequences are increasingly physical — cancelled surgeries, halted production lines, empty shelves — which is why several governments now treat ransomware as a national-security issue.

Prevention: closing the front doors

• Patch internet-facing systems fast — within days for actively exploited vulnerabilities. Subscribe to CISA's Known Exploited Vulnerabilities catalogue and treat it as a to-do list.
• MFA on every remote access path, phishing-resistant for administrators. No exposed RDP.
• Endpoint detection and response (EDR) on every server and workstation, with someone watching it — or a managed service doing so.
• Least privilege and tiered administration so a compromised user account can't reach domain admin. Separate admin accounts, privileged access workstations, no local admin for users.
• Network segmentation so encryption of one zone doesn't spread to all.
• Email and web filtering plus the awareness programme covered in Phishing.

Resilience: making the outcome survivable

Assume prevention will fail eventually. What determines whether that's a bad week or an existential event:

• Backups the attacker cannot reach. The 3-2-1 rule updated: three copies, two media, one offline or immutable (object-locked cloud storage, air-gapped tape, or a backup system with separate credentials and MFA). Test restores — a backup you've never restored from is a hypothesis.
• A tested incident response plan with roles, contact lists on paper, legal counsel, a forensics firm on retainer, and pre-agreed decisions about isolation, communication and payment. Run a tabletop exercise annually with executives in the room.
• Logging that survives — centralised, retained, and not deletable with domain-admin rights — so forensics can establish what was taken.
• Cyber insurance that you've read the exclusions of, understanding that insurers now require the controls above as conditions of cover.

To pay or not

Law enforcement, most governments and most security professionals advise against paying: it funds the next attack, there's no guarantee of a working decryptor or of data deletion, and payment to sanctioned groups is illegal in many jurisdictions. Some countries are moving to ban payments by public bodies outright. Organisations with working, tested backups rarely need to consider it — which is the real argument for the resilience work above. If you're in the position of deciding, involve legal counsel and law enforcement before anyone contacts the attacker.