iTechGuides is reader-supported. When you buy through links on our site, we may earn an affiliate commission. As an Amazon Associate I earn from qualifying purchases. Learn more
Ransomware usually is not a single file that suddenly encrypts a computer. It is typically a hands-on-keyboard intrusion: an attacker gets an initial foothold, expands control, finds valuable systems and data, steals information, and only then encrypts systems or threatens disclosure. Encryption is often the most visible stage of a compromise that may have been active for days or weeks.
The practical sequence is initial access → consolidation and preparation → impact. Within those phases, operators execute tools, establish persistence, discover hosts and identities, obtain higher privileges, move laterally, disable defenses, collect data, exfiltrate it, and apply pressure with encryption, publication threats, or both.
The ransomware lifecycle at a glance
CISA describes ransomware as “a form of malware designed to encrypt files on a device, rendering them and the systems that rely on them unusable.” Modern incidents often add theft and extortion to that impact. CISA’s LockBit advisory groups the activity into three broad phases:
Windows Errors? Fix Them Before They Spread
Repair common Windows errors and clear accumulated junk for a smoother, more stable PC - no reinstall needed.Free scan · no reinstallCrashes, No Sound, or Screen Glitches?
Random freezes, missing sound and display glitches usually trace back to one bad driver. Find and replace yours safely.Free scan · under a minute| Phase | What operators do | Typical outcome |
|---|---|---|
| Initial Access | Enter through phishing, valid accounts, exposed remote services, internet-facing vulnerabilities, precursor malware, or a supplier or managed-service-provider connection. | A foothold on a device, account, network, or remote service. |
| Consolidation and Preparation | Run tools, maintain access, discover hosts and shares, steal credentials, escalate privileges, move laterally, find backups and high-value data, weaken defenses, and stage files. | Control over enough of the environment to maximize disruption and extortion leverage. |
| Impact on Target | Exfiltrate data, encrypt systems, delete recovery options, and demand payment or threaten publication. | Unavailable systems, stolen information, operational disruption, and ransom pressure. |
These phases overlap. An operator may move back and forth between discovery, credential theft, and lateral movement rather than complete one clean step at a time.
#1 Best Overall
1. Initial access: how ransomware gets into a network
The first step is obtaining a usable foothold. Malware delivery is only one route; stolen credentials and exposed remote access can be just as important.
Phishing and malicious content
Phishing messages can deliver a malicious attachment, link to a credential-harvesting page, or persuade an employee to run a file or approve an unexpected sign-in. A stolen username and password can be more valuable than a single infected workstation because the attacker can use the account through normal remote services.
Compromised or purchased valid accounts
Criminal groups may buy credentials, reuse passwords exposed in earlier breaches, or take over an employee, administrator, contractor, or supplier account. Valid-account use can blend into ordinary activity and may bypass controls that focus only on unknown malware.
Exposed RDP, VPN, and other remote services
Remote Desktop Protocol, virtual private network gateways, and other internet-facing administration services are attractive entry points when they are exposed unnecessarily, protected by weak or reused passwords, or missing strong multifactor authentication. Removing unneeded exposure and requiring phishing-resistant MFA directly reduces this route.
Internet-facing vulnerabilities
Attackers scan public systems for unpatched vulnerabilities in firewalls, email platforms, remote-access appliances, web applications, and other edge services. Fast patching matters most for systems reachable from the internet and for flaws that allow authentication bypass, remote code execution, or privilege escalation.
Precursor malware and third-party access
Initial access can arrive through a previous malware infection or through a supplier, contractor, cloud tenant, or managed-service provider. A trusted connection can give an attacker a path that is difficult to distinguish from legitimate administration, so third-party accounts and remote tools need their own scope, logging, and review.
2. Execution, persistence, and discovery after entry
Once inside, operators usually test what they can do before attempting the final impact. MITRE ATT&CK treats execution, persistence, discovery, and command and control as separate tactics because each solves a different problem.
Quick wins for a faster PC:
Repair Windows errors before they cause bigger problemsFix Now →Scan for outdated or missing drivers - takes under a minuteDriver Scan →Clear out junk files and repair common Windows errorsFree Scan →Execution
Attackers run commands and payloads through stolen accounts, scripts, scheduled tasks, remote-management tools, or legitimate administration utilities. Using built-in tools can reduce the number of unfamiliar files that defenders see.
Persistence and command and control
Persistence gives the intruder a way back after a password reset or reboot. Possible mechanisms include newly created accounts, scheduled tasks, services, startup locations, remote-access software, or compromised credentials. Command-and-control channels let operators issue instructions, upload tools, and retrieve results while remaining interactive.
Discovery
Operators enumerate computers, domains, users, groups, shared folders, software, security products, backup servers, and network routes. They look for file servers, virtualization infrastructure, identity systems, databases, and other systems whose loss would create maximum pressure. Discovery also reveals which controls might detect or block the next stage.
3. Privilege escalation and credential access
A foothold on one workstation rarely gives an attacker the reach needed to disrupt an entire organization. The next objective is usually a more powerful account, preferably local administrator, domain administrator, or an equivalent cloud or infrastructure role.
What’s actually slowing this PC down?
Pick the symptom - the matching free tool is one click away.
How privileges increase
Operators may exploit an unpatched local vulnerability, abuse excessive permissions, take over a service account, or find credentials stored in scripts, browsers, configuration files, memory, or password stores. They also search for administrators who have logged on to the compromised machine.
Credential dumping and valid-account abuse
Credential dumping extracts password material, hashes, tokens, or other authentication secrets. Recovered credentials can then be tested against file servers, domain controllers, VPNs, cloud consoles, and backup systems. Because the resulting logins may be valid, identity telemetry and unusual access patterns are essential.
Observed Play activity
In the Play case, CISA reported credential-dumping activity, use of Mimikatz, WinPEAS enumeration, and abuse of valid accounts. Those tools and techniques illustrate the division of labor in an intrusion: one tool identifies weaknesses, another obtains secrets, and valid credentials provide access to additional systems.
4. Lateral movement and preparation for impact
Lateral movement turns a single compromised host into an enterprise-wide incident. Attackers use remote services and administrative utilities to reach more machines, repeat discovery, and prepare the environment for simultaneous disruption.
Common movement paths
- Remote services: RDP, VPN connections, file-sharing protocols, and other management interfaces.
- Administrative utilities: PsExec, Group Policy, and similar tools that can execute commands across many endpoints.
- Operator frameworks and loaders: Cobalt Strike, SystemBC, and comparable tooling that provide interactive control or a route for additional payloads.
- Stolen privileged accounts: credentials that allow access without deploying a conspicuous new exploit.
Disabling defenses and recovery
Before encryption, operators may stop security agents, alter policies, delete shadow copies, change backup settings, or remove logs. These actions reduce the chance of interruption and make restoration harder. A security product that is deployed but can be disabled by the same accounts used for administration is a weak barrier at this stage.
Why segmentation changes the outcome
Network segmentation restricts which systems can communicate and which accounts can administer them. Separating user networks from servers, identity systems, backup infrastructure, and management planes limits east-west traffic. It cannot guarantee prevention, but it can stop a compromised workstation from reaching every critical system and reduce the blast radius.
5. Collection and data exfiltration
In many modern campaigns, data theft happens before encryption. Attackers identify documents, databases, email stores, source code, contracts, credentials, and other information that can be used to pressure the victim, then compress or stage it for transfer.
How data leaves the environment
Exfiltration may use ordinary web traffic, cloud file-storage services, FTP or SFTP, or purpose-built synchronization tools. CISA specifically identifies Rclone and Rsync, abnormal outbound volume, tunneling over common ports, web-based file storage, and FTP/SFTP as activity worth investigating.
Signals defenders should investigate
- Large outbound transfers from a workstation or server that normally sends little data.
- New use of Rclone, Rsync, FTP, SFTP, or tunneling utilities.
- Connections to unfamiliar storage providers or destinations, especially outside normal business regions.
- Archive creation followed by a burst of outbound traffic.
- Outbound transfers by accounts or hosts with no normal business reason to move sensitive files.
Volume alone is not proof of theft: backups, software updates, and legitimate data processing can also generate large transfers. Investigators should correlate destination, account, process, timing, and the files accessed.
6. Encryption, extortion, and the final impact
Encryption as an operational weapon
After gaining enough control, the operator deploys ransomware broadly. Encryption can target user files, shared drives, virtual machines, databases, and other systems that support operations. Attackers may use intermittent encryption, which encrypts selected portions of large files to speed deployment while still making them unusable.
Double extortion
When attackers both encrypt systems and threaten to publish stolen data, CISA calls the combination “double extortion.” The victim must then consider two separate harms: restoring availability and preventing disclosure. Paying for a decryptor would not, by itself, guarantee that stolen data is deleted or kept private.
Data-only extortion
Some campaigns steal information and threaten publication without encrypting systems. This can affect organizations that maintain good backups but still hold sensitive personal, financial, health, legal, or proprietary data.
A concrete example: the Play intrusion
CISA reports that Play gained access through valid accounts, exploited public-facing FortiOS and Microsoft Exchange vulnerabilities, and used external RDP and VPN services. Operators used Cobalt Strike, SystemBC, PsExec, Mimikatz, WinPEAS, and Group Policy to execute and move through the environment.
Following exfiltration, CISA states that Play encrypted files with AES-RSA hybrid encryption using intermittent encryption. The sequence demonstrates why an alert that appears to be “just ransomware” may follow credential theft, vulnerability exploitation, remote access, internal reconnaissance, and data theft.
Independent reader supportYour contribution helps us test, update, and keep practical guides available for everyone.Defensive controls mapped to each stage
No single control replaces the others. A security key, segmentation, endpoint detection and response, and an immutable backup address different failure points.
| Attack stage | Priority controls | What the control changes | Operational considerations |
|---|---|---|---|
| Initial access | Phishing-resistant MFA; rapid patching of internet-facing systems; removal of unnecessary RDP exposure; third-party access review. | Reduces successful phishing, password reuse, remote-service abuse, and exploitation of edge systems. | Requires hardware or platform support for strong MFA, patch governance, and an inventory of exposed services and suppliers. |
| Privilege and credentials | Least privilege; just-in-time administration; credential protection; review of newly created or escalated accounts. | Limits what a stolen account can do and makes abnormal privilege changes more visible. | Can require redesign of service accounts and emergency-access procedures. |
| Lateral movement | Network segmentation; restricted east-west traffic; EDR visibility; control of remote administration tools. | Reduces reachable systems and exposes unusual execution or remote logons. | Segmentation must include management, identity, virtualization, and backup networks, not only user VLANs. |
| Exfiltration | Egress monitoring; unusual-volume alerts; governance of web file-sharing; investigation of Rclone, Rsync, FTP, SFTP, and tunneling. | Raises the chance of detecting theft before or during transfer. | Requires baseline knowledge of legitimate backup, collaboration, and data-transfer workloads. |
| Recovery and impact | Offline, encrypted, immutable backups; regular restoration exercises; coordinated incident response. | Preserves a recovery path even if production systems and online backups are compromised. | Backups must cover the organization’s infrastructure and be tested, not merely reported as successful. |
What to do when the sequence is suspected
- Contain without destroying evidence. Isolate affected endpoints and restrict suspicious accounts or remote services. Coordinate actions so investigators retain logs, memory, and relevant disk images where feasible.
- Protect identity and administration. Disable compromised accounts, rotate exposed credentials, revoke active sessions and tokens, and move administration to known-clean systems.
- Stop further spread. Restrict east-west traffic, disable unnecessary remote access, and block known malicious destinations or tools while preserving legitimate emergency communications.
- Determine whether data was stolen. Review file-access logs, archive creation, outbound volume, DNS and proxy records, cloud-storage activity, and use of Rclone, Rsync, FTP, or SFTP.
- Preserve and analyze evidence. Establish a timeline from the first suspicious login or exploit through discovery, privilege changes, lateral movement, exfiltration, and encryption.
- Recover deliberately. Verify that the intrusion is contained, rebuild or clean systems as appropriate, restore from offline and immutable backups, and monitor restored environments for renewed access.
- Coordinate response. Involve legal counsel, incident-response specialists, insurers where applicable, regulators when required, and law enforcement. Do not assume that a ransom payment resolves the security or disclosure risks.
Why backups are a security control, not just an IT task
CISA recommends backups that are offline, encrypted, immutable, broad enough to cover the organization’s infrastructure, and maintained and restored regularly. Offline or otherwise isolated copies prevent an attacker with production administrator rights from deleting every recovery point. Immutability helps prevent alteration; encryption protects the backup if storage is exposed; restoration practice proves that the organization can actually use the copies under pressure.
Free tools Windows power users keep installed
One-click scans. No signup required.
Recovery planning should identify which identity systems, management platforms, network services, applications, and data must return first. Restoring files without restoring trustworthy identity and administration can recreate the attacker’s access path.
The key distinction: the encryption event is not the whole attack
Ransomware is best understood as a sequence of access, control, preparation, theft, and impact. Stopping phishing alone leaves exposed remote services and stolen accounts in play. Buying endpoint detection alone does not replace segmentation or tested recovery. Backups reduce the effect of encryption but do not prevent data theft. Layered controls work because they interrupt different points in the chain and limit how far an attacker can go when one control fails.
Quick Recap
Product prices and availability are accurate as of the date/time indicated and are subject to change. Any price and availability information displayed on Amazon at the time of purchase will apply.
