Anatomy of a Ransomware Attack: From Initial Access to Extortion

Here is the paradox that defines ransomware in 2026: there have never been more attacks, and there have never been fewer people paying for them. The Verizon 2025 Data Breach Investigations Report found ransomware present in 44% of all analyzed breaches, up from 32% the year before, and in a staggering 88% of breaches at small and medium-sized businesses. Yet Coveware reports that only about 20% of victims paid a ransom in Q4 2025 — the lowest rate it has ever recorded — and the DBIR’s median ransom paid dropped to $115,000, with 64% of victims paying nothing at all.

That collapse in the payment rate is not a sign that ransomware is losing. It is the reason the modern attack looks the way it does. When you cannot count on the encryption itself extracting money, you steal the data first and turn the breach into a data-leak threat that a good backup cannot undo. The modern ransomware intrusion is less about locking files and more about owning your network long enough to take everything worth taking. This post walks a single realistic intrusion from first foothold to ransom note, maps every stage to MITRE ATT&CK, and shows exactly where a defender can break the chain.

The business behind the breach

Before we touch a single technique, understand that a ransomware incident is rarely one actor doing everything. It is an assembly line, and the division of labor is the whole point.

Initial Access Brokers

Initial Access Brokers (IABs) are specialists who breach networks and then sell that foothold — a set of valid VPN credentials, an exploited edge appliance, a live RDP session — to whoever wants it. They do not deploy ransomware themselves. They wholesale access, often for a few hundred to a few thousand dollars, and let someone else monetize it. This specialization is why the “initial access” and “everything after” phases of an attack frequently belong to different people with different toolsets.

Ransomware-as-a-Service

Ransomware-as-a-Service (RaaS) is the other half of the market. An operator (the “brand”) builds and maintains the encryptor, the victim-facing negotiation portal, and the dark-web data-leak site. Affiliates do the hands-on intrusion using access they bought or built themselves, then run the operator’s encryptor. Affiliates typically keep the large majority of the proceeds — often 80-90% — with the operator taking the rest as a platform fee.

The instability of these brands is instructive. In early 2024, law enforcement’s Operation Cronos disrupted LockBit, and ALPHV/BlackCat collapsed in an apparent exit scam. Displaced affiliates needed a new home, and RansomHub — an operation researchers have linked to the earlier Knight/Cyclops RaaS — recruited them aggressively with a roughly 90% affiliate cut. It briefly dominated leak-site postings before its own infrastructure went dark around April 1, 2025, with affiliates scattering to groups like Qilin and DragonForce. The lesson for defenders: do not anchor your defense to a brand name. Affiliates, tooling, and tradecraft persist and get reused even as logos come and go. Defend against the techniques, not the mascot.

Stage 1 — Initial access [TA0001]

Four vectors dominate the way operators get their first foothold, and CISA’s #StopRansomware Guide is organized around exactly these entry points.

Phishing (T1566). Still a workhorse for delivering a loader or harvesting credentials, especially against organizations without phishing-resistant MFA on webmail.
Exploiting public-facing edge and VPN devices (T1190). This is the fastest-growing vector. Verizon documented roughly an 8x rise (from 3% to 22%) in edge-device and VPN exploitation as an initial access route. Of the 59 KEV entries that CISA flagged for known ransomware use in 2025, 19 targeted network and edge appliances from vendors like Ivanti, Fortinet, Citrix, and Palo Alto. Named examples worth patching against yesterday: CitrixBleed 2 (CVE-2025-5777), a pre-auth memory-disclosure flaw in Citrix NetScaler ADC/Gateway rated CVSS 9.3, and CVE-2025-0282, an unauthenticated stack-based buffer overflow in Ivanti Connect Secure that enables remote code execution.
External remote services, including exposed RDP (T1133). An RDP port hanging off the public internet remains an open invitation to credential brute-forcing.
Valid accounts (T1078). CrowdStrike’s 2025 Global Threat Report highlights the rise of malware-free, identity-based intrusions — attackers simply logging in with legitimate credentials, which are far harder to catch than dropped malware.

A concrete anchor: CISA’s Akira advisory (AA24-109A) describes a RaaS crew that gained access by likely abusing SonicWall vulnerability CVE-2024-40766 and by brute-forcing VPN credentials on accounts without MFA. Akira claimed roughly $244 million in proceeds as of late September 2025.

Stage 2 — Establish and escalate

Once inside, the operator moves fast. CrowdStrike measured an average adversary “breakout time” — from first foothold to first lateral movement — of just 48 minutes, with the fastest observed at 51 seconds. This is hands-on-keyboard work, not a slow-burning automated worm.

Execution and persistence

Expect PowerShell (T1059.001) for execution and tooling download, scheduled tasks for persistence, and — the quietest option — continued use of the valid accounts they already own. The goal is a stable presence that survives a reboot without tripping alarms.

Credential access — the skeleton key

The pivotal move is credential theft. If initial access is the front door, stolen credentials are the master key that opens every other door without breaking anything. The primary technique is OS Credential Dumping: LSASS Memory (T1003.001) — extracting plaintext passwords, NTLM hashes, and Kerberos tickets straight out of the Local Security Authority Subsystem Service process, commonly with Mimikatz or ProcDump. Operators also dump the SAM database (T1003.002) and, once they reach a domain controller, run DCSync (T1003.006) to impersonate a DC and pull password hashes for the entire domain — including the krbtgt account, which enables forged Kerberos tickets.

Credential theft is what turns a single compromised host into a compromised domain. Every downstream stage — lateral movement, defense evasion, mass encryption — rides on the credentials harvested here. Protecting LSASS is not a nice-to-have; it is the hinge of the whole intrusion.

Stage 3 — Expand: discovery and lateral movement [TA0008]

With credentials in hand, the operator maps the environment: Active Directory structure, domain admins, file servers, backup infrastructure, and the security tooling in place. Then they move. The RansomHub advisory (AA24-242A) describes the canonical pattern precisely — affiliates disable EDR, dump credentials or spray passwords, and move laterally before exfiltrating and encrypting.

Movement rides on legitimate administrative channels: RDP, SMB, PsExec, and WMI. For command-and-control, crews reach for commercial and cracked offensive frameworks — Cobalt Strike beacons remain the classic, with Sliver and Brute Ratel increasingly common as detection catches up to Cobalt Strike. The strategic shift to note is “living off the land”: with valid credentials and native Windows tooling, an operator can traverse a network while looking almost exactly like a busy sysadmin. There is often no malware to detect at this stage — only behavior.

Stage 4 — Go quiet: defense evasion [TA0005]

Before the loud part, the operator blinds the defenders. This stage produces some of the highest-signal detection opportunities in the entire attack, because the actions here have almost no legitimate business analog.

Killing the EDR

Impair Defenses: Disable or Modify Tools (T1562.001) is the objective. Older families used blunt instruments — WastedLocker leaned on taskkill and mpcmdrun to stop security software, and XingLocker disabled Windows Defender real-time protection via registry edits. The modern escalation is BYOVD (bring-your-own-vulnerable-driver): the operator loads a legitimately signed but vulnerable driver, then abuses it to kill security agents from the kernel, below where most user-mode EDR can defend itself. RansomHub’s EDRKillShifter tool is a documented example of this pattern.

Deleting the safety net

Inhibit System Recovery (T1490) — destroying the local backups that would let you recover without paying — is one of the most common ransomware behaviors, and one of the loudest. The literal commands to alert on:

:: Delete all Volume Shadow Copies, silently
vssadmin.exe Delete Shadows /all /quiet

:: Alternate path via WMI
wmic shadowcopy delete

:: Newer, stealthier variant: instead of a "delete" command,
:: resize shadow storage to near-zero via DeviceIoControl so old
:: copies are silently evicted -- evades command-line detection
:: (no vssadmin/wmic string to match on)

A legitimate administrator almost never mass-deletes shadow copies across a fleet. Alerting on vssadmin Delete Shadows and wmic shadowcopy delete is one of the cheapest, highest-yield detections you can deploy. The DeviceIoControl variant matters precisely because it removes the command-line string defenders lean on — which is why you also want behavioral detection on the shadow storage service itself, not just process command lines.

Clearing the logs

Clear Windows Event Logs (T1070.001) removes the forensic trail. Shipping logs off-host to a SIEM in real time defeats this — you cannot delete what has already left the building.

Stage 5 — The steal: collection and exfiltration [TA0010]

This is the stage that rewrote the entire threat model. By Q3 2025, BlackFog reported data exfiltration in roughly 96% of ransomware attacks, and Mandiant observed confirmed or suspected data theft in about 77% of the ransomware intrusions it handled — up from roughly 57% the year before. The operator stages data (often compressed and split with 7-Zip or WinRAR) and ships it out. The tools are commodity and dual-use, which is what makes them hard to block outright:

rclone — one of the most frequently observed exfiltration tools, able to sync to Google Drive, Amazon S3, MEGA, and FTP endpoints.
MEGAsync / MEGAcmd — cloud storage favored for exfiltration destinations.
WinSCP, FileZilla, curl — straightforward transfer utilities that blend into normal admin traffic.

Once the data is gone, the encryption is almost a formality — the real weapon is now sitting on the attacker’s storage. This is precisely why a pristine, immutable backup no longer neutralizes the threat: you can restore every file and still face publication of your customer records.

Stage 6 — The squeeze: encryption and extortion tiers

Only now does the operator trigger Data Encrypted for Impact (T1486). Modern encryptors frequently use intermittent encryption — encrypting only portions of each file — to move faster and evade detection heuristics that watch for full-file rewrites; CISA’s Play advisory (AA23-352A) documents this behavior. Akira’s Rust-based “Megazord” encryptor appends a .powerranges extension, a reminder that the file-renaming storm itself is a detectable event.

Then comes the note: a dropped ransom message pointing to a Tor-based negotiation portal with a countdown timer and a chat window. The extortion model has tiers:

Single extortion: encryption only. Pay for the decryptor. A solid backup defeats this.
Double extortion: encrypt and threaten to publish the stolen data on a dark-web leak site. Backups do not defeat this — the data is already gone.
Triple extortion: add DDoS attacks and/or direct harassment of the victim’s customers, employees, and regulators to increase pressure.

Connect this back to the economics from the top: with only ~20% of victims paying, operators lean harder on tiers 2 and 3, because the data-leak threat is what still moves money when the decryptor no longer does.

The timeline

How long does all of this take? The honest answer requires figures with different methodologies. Mandiant’s M-Trends 2026 reports a 14-day global median dwell time across all intrusion types — inflated by slow espionage cases — while noting that attackers have compressed initial-access-to-handoff to about 22 seconds. Sophos’s State of Ransomware 2025, measuring ransomware alone, found that over half of victims recovered within a week. CrowdStrike’s 48-minute breakout time fills in the middle. The gap between these numbers is explainable: Mandiant spans all incident types, while ransomware itself is fast and financially driven. The realistic modern ransomware kill chain is hours-to-days, not weeks.

MODERN RANSOMWARE KILL CHAIN -- compressed timeline
====================================================
T+0 min    Initial access: exploit unpatched VPN appliance (T1190)
           -- OR valid VPN creds from an IAB, no MFA (T1078/T1133)
T+2 min    First C2 beacon checks in (Cobalt Strike / Sliver)
T+48 min   Breakout: first lateral movement (CrowdStrike avg)
Hr 2-8     LSASS dumping w/ Mimikatz (T1003.001); AD discovery;
           DCSync from a domain controller (T1003.006)
Day 1-2    Spread via RDP/SMB/PsExec/WMI to file & backup servers;
           stage archives w/ 7-Zip; exfil via rclone -> MEGA (T1567)
Day 2-4    BYOVD kills EDR (T1562.001); clear event logs (T1070.001);
           vssadmin Delete Shadows /all /quiet (T1490);
           deploy encryptor (T1486); drop ransom note
====================================================
44% of attacks now stopped BEFORE encryption -- a six-year
high, per Sophos State of Ransomware 2025

Breaking the chain

The strategic insight of the whole walkthrough is this: the intrusion is noisy at multiple stages, and a working control at any stage can downgrade a catastrophe into a contained incident. You do not need a perfect wall. You need defense-in-depth mapped to the kill chain, anchored to the CISA #StopRansomware Guide, NIST IR 8374 (the CSF ransomware profile), and NIST SP 800-63B for authentication.

Initial access

Deploy phishing-resistant MFA (FIDO2/WebAuthn per NIST SP 800-63B) everywhere it matters most — VPN, webmail, and all privileged accounts. This single control defeats the majority of valid-account and phishing entries.
Patch internet-facing edge devices fast. The window between disclosure and mass exploitation of VPN/firewall CVEs is now measured in days. Treat edge-appliance patches as emergencies.
Do not expose RDP to the internet. Put it behind a VPN or a zero-trust access gateway.

Credential access

Protect LSASS with Credential Guard and run it as a protected process (PPL) so tools like Mimikatz cannot read its memory.
Disable NTLM where feasible and tier your administrative accounts so a workstation compromise cannot harvest domain-admin credentials.

Lateral movement

Network segmentation and micro-segmentation so a foothold on one subnet cannot freely reach backup servers and domain controllers.
Restrict PsExec, SMB, and WMI between workstations, and alert on their use from non-admin hosts.

Defense evasion and detection

Run EDR with tamper protection enabled, and monitor for BYOVD driver loads.
Ship logs off-host to a SIEM in real time so log-clearing (T1070.001) fails.
Alert on the high-signal behaviors: vssadmin Delete Shadows, wmic shadowcopy delete, unexpected PsExec, and mass file-rename bursts. These are near-zero-false-positive triggers.

Exfiltration and impact

Monitor egress for rclone, MEGA endpoints, and anomalous outbound volume. Data leaving is your last chance to intervene before the extortion leverage exists.
Keep 3-2-1 backups — three copies, two media types, one offsite — with at least one copy offline and immutable so an attacker with domain admin still cannot alter or delete it. CISA endorses this explicitly.

Key Takeaways

The economics changed the attack. With only ~20% of victims paying (Coveware Q4 2025) but ransomware in 44% of breaches (Verizon DBIR), operators now steal data first — roughly 96% of attacks exfiltrate — so a backup alone no longer neutralizes the threat.
Defend techniques, not brands. The RaaS/IAB assembly line and the LockBit-to-RansomHub churn mean affiliates and tooling persist even as logos die. Map your defenses to MITRE ATT&CK, not to the ransomware name of the week.
Credential theft is the hinge. LSASS dumping (T1003.001) and DCSync (T1003.006) turn one host into a whole domain. Credential Guard, NTLM reduction, and admin tiering pay for themselves.
The attack is loud where it counts. Shadow-copy deletion (T1490), EDR tampering (T1562.001), PsExec, and mass file renames are near-zero-false-positive detections — instrument them.
Speed is the new normal. A ~48-minute breakout time and access handed off in as little as 22 seconds mean detection must be fast and automated; weeks-long dwell time is no longer a safe assumption.
Defense-in-depth wins. A working control at every stage — MFA, fast edge patching, segmentation, tamper-proof EDR, and offline immutable backups — is why 44% of attacks are now stopped before encryption (Sophos 2025), a six-year high.

References

« Reading Email Headers: Tracing a… Anatomy of a Phishing URL:… »