The first days of a ransomware intrusion: what happens before the encryption

When a company announces a ransomware attack, the story usually starts on the day the screens went dark. For the attackers, that day is the end of the job. Encrypting files is fast; what comes before it, getting in, finding the valuable systems, taking control of the domain and stealing data, can take days or weeks. That earlier stretch is where defenders have their best chance, because every step leaves traces and none of them is yet the disaster.

This article walks through those first days stage by stage, using the language of MITRE ATT&CK, and points out the signals a SOC can catch at each one. It describes the common pattern behind many human-operated ransomware attacks, not any single group: real intrusions skip, reorder and repeat these steps.

Stage 1: getting in

Ransomware operators rarely need anything exotic to get a foothold. CISA's #StopRansomware Guide groups the common entry points into a short list:

• Exposed remote access: VPN gateways and Remote Desktop exposed to the internet, signed into with stolen or guessed passwords. MITRE tracks these as External Remote Services (T1133) and Valid Accounts (T1078).
• Unpatched internet-facing systems: firewalls, VPN appliances and file transfer servers with known vulnerabilities.
• Phishing: a malicious attachment or link that installs a loader on a workstation.

Sometimes the people who break in are not the ones who deploy the ransomware. Access brokers sell footholds in company networks, and a ransomware affiliate buys one and takes it from there.

Where defenders can stop it: MFA on every remote access path, patching internet-facing systems first, and alerts for sign-ins to the VPN from unusual countries or for accounts that log in for the first time in months.

Stage 2: making sure they can come back

A single stolen password can be changed. The first thing many operators do after getting in is to install a second, more reliable way back: a legitimate remote management tool such as AnyDesk or a similar product (Remote Access Software, T1219), a new local account, a scheduled task or a service.

Using legitimate tools is deliberate. A remote support application signed by a real vendor does not look like malware to antivirus, and in many companies IT staff use exactly the same products.

Where defenders can stop it: know which remote access tools your organization actually uses and alert on any other one being installed. New services and scheduled tasks on servers are worth reviewing, especially outside change windows.

Stage 3: learning the network

Next the attackers map their surroundings. They list domain controllers, administrator accounts, file servers, backup servers and trust relationships between domains (Domain Trust Discovery, T1482). Much of this is done with built-in Windows commands and Active Directory queries, a textbook case of living off the land, sometimes helped by free network scanners.

To an attacker, the backup server is one of the most important finds. If backups survive, the victim may not need to pay.

Where defenders can stop it: a workstation that suddenly queries Active Directory for every administrator, or scans hundreds of hosts on file-sharing ports, is behaving very differently from a normal user. Endpoint and identity tools often flag this enumeration, and it is a good subject for threat hunting.

Stage 4: becoming an administrator

The foothold account is usually an ordinary user. To deploy ransomware across the company, the attackers need more: domain administrator rights, or at least control of the systems that manage the servers. This privilege escalation typically comes from credentials rather than exploits:

• Dumping credentials from memory, for example by reading the memory of the LSASS process on a machine where an administrator has logged in (T1003.001).
• Attacking Active Directory itself, with techniques such as Kerberoasting against service accounts with weak passwords.
• Finding passwords lying around, in scripts, shared documents or old configuration files.

With an administrator's credentials, they spread through the network using the same tools administrators use: Remote Desktop, remote PowerShell, and remote service creation. That lateral movement often ends at a domain controller.

Where defenders can stop it: administrator accounts that are only used on administrative machines, never on ordinary workstations, take away most of what credential dumping can find. Access to LSASS by unexpected programs, and an administrator account logging in to dozens of hosts in an hour, are strong signals.

Stage 5: stealing the data

Before encrypting anything, most groups now copy data out of the network. Stolen files are leverage: even a victim who restores everything from backups faces the threat of publication. This combination is known as double extortion.

The data exfiltration itself often looks unremarkable: files compressed into archives on a file server, then uploaded to a cloud storage service or a file-transfer site with a legitimate sync tool (Exfiltration Over Web Service, T1567).

Where defenders can stop it: large outbound transfers from servers that normally send little, archiving tools running on file servers, and sync tools that IT never installed. This is often the last stage where an intervention prevents the encryption entirely.

Stage 6: preparing the ground

Just before the final step, the attackers remove whatever could save the victim or stop the deployment:

• Security tools are disabled or uninstalled, using the stolen administrator rights (Impair Defenses, T1562).
• Backups are deleted or encrypted, and Windows volume shadow copies are removed so files cannot be restored locally (Inhibit System Recovery, T1490).
• The ransomware is staged on a shared folder, ready to be pushed to every machine through group policy, remote services or a management tool.

Where defenders can stop it: tamper protection on endpoint security, so that even an administrator cannot silently turn it off, and alerts on shadow copy deletion and on mass changes to group policy. At this stage there may be only hours left.

Stage 7: impact

The encryption itself (Data Encrypted for Impact, T1486) is often launched outside office hours, on a night or a weekend, when fewer people are watching. Ransom notes appear, systems stop, and the incident response begins in earnest.

What this means for defenders

Looking at the full sequence changes where to put effort:

• Most stages use legitimate tools and valid accounts. Detection depends less on spotting malware and more on spotting behavior that is unusual for that account, host or time.
• Each stage is a chance. The attackers have to succeed at every step; defenders only need to catch one of them early enough.
• Backups need protecting, not just making. CISA recommends keeping offline, encrypted backups and testing that they can actually be restored. A backup the attackers can reach with a domain administrator account is not a recovery plan.
• Speed matters once something is found. An alert at stage 2 or 3 is an incident to act on immediately: disable the account, isolate the host and look for the other ways in, because there are usually more than one.

Why it matters for a SOC analyst

Many of the alerts a SOC analyst closes as "probably admin activity" are exactly the kind of signals ransomware operators create in their first days: a new remote access tool, an unusual scan, an administrator logging in somewhere new. Knowing the sequence helps you ask the right follow-up question: if this is the beginning of an intrusion, what would come next, and can I see it?