Ransomware Stopped Being About Encryption — Here Is the Current Playbook
Table of Contents
- Backups Stopped Being Enough
- The Current Attack Sequence
- Initial Access Is a Market
- The Dwell Time Nobody Notices
- Why Exfiltration Changed the Economics
- Detection Opportunities in Order
- Controls Ranked by Actual Effect
- What Recovery Actually Requires
- Common Pitfalls
- Conclusion
- Frequently Asked Questions
Key takeaway: The encryption event is the end of the attack, not the beginning. By the time files are locked, the operator has typically been inside for weeks and has already taken your data. Detection must target the earlier stages, because the final one is unrecoverable by definition.
Backups Stopped Being Enough
For years, the ransomware answer was straightforward: maintain good backups, restore, refuse to pay. That answer was correct and is now insufficient.
Operators adapted in a specific way. Before deploying encryption, they exfiltrate data. The extortion demand then covers two separate things — a decryption key you may not need, and a promise not to publish the data you cannot replace.
This is double extortion, and it changed the calculation entirely. Restoring from backup addresses availability. It does nothing about the copy of your customer database sitting on an operator’s infrastructure. A company with flawless backups still faces regulatory notification obligations, customer disclosure, litigation exposure, and publication of internal documents.
Some groups now skip encryption altogether. Encryption is noisy, triggers alerts, and requires deploying tooling across an estate. Stealing data and demanding payment for silence achieves the leverage without any of that operational risk. This variant is harder to detect precisely because nothing breaks.
The practical implication is that a ransomware programme built around backup and recovery is defending against a threat model from several years ago.
The Current Attack Sequence
The stages are consistent enough across groups to be useful as a defensive framework.
Initial access. Purchased from a broker, obtained through credential stuffing against an internet-facing service without multi-factor authentication, or gained by exploiting an unpatched edge device. Phishing remains common and is no longer the dominant vector.
Establish persistence. Deploy remote access tooling — frequently legitimate remote administration software, because it is signed, expected, and rarely flagged. Create accounts. Register scheduled tasks.
Discovery. Enumerate the domain, map network shares, identify backup infrastructure and security tooling, find the file servers holding valuable data. This stage is largely conducted with built-in operating system utilities.
Credential access. Harvest credentials from memory, extract them from configuration files and scripts, target service accounts and administrators. This is where an incident becomes serious.
Lateral movement. Move between hosts using the harvested credentials and legitimate remote administration protocols. Rarely involves malware at this stage.
Defence evasion. Disable endpoint protection, clear logs, stop backup services, delete shadow copies. The presence of these actions is a strong signal that encryption is imminent.
Exfiltration. Transfer data out, typically to cloud storage or file-sharing services, over days.
Impact. Deploy encryption, delete backups, leave the ransom note.
Note how much of this uses legitimate tooling. Detection strategies keyed to malware signatures see very little of this sequence, which is why behavioural detection matters more than file-based detection.
Initial Access Is a Market
An underappreciated structural fact: the people who break in are frequently not the people who deploy the ransomware.
Initial access brokers specialise in obtaining and selling footholds — valid credentials, active remote access sessions, compromised infrastructure. Ransomware affiliates purchase this access and conduct the rest of the operation. The ransomware itself is provided as a service by a separate group taking a percentage.
This specialisation has two defensive implications.
First, the attack against you may have begun long before the operator who encrypts your files became involved. Credentials stolen in an unrelated breach eighteen months ago can be the entry point today, which is why credential hygiene has a long tail.
Second, initial access is frequently unglamorous. Not a sophisticated exploit chain — a valid password on a VPN without multi-factor authentication, or an unpatched edge appliance, or a remote desktop service exposed to the internet. The sophistication appears later in the operation, and the entry point is usually a control failure rather than a defensive gap that required advanced attack capability to breach.
The Dwell Time Nobody Notices
Between initial access and encryption, operators are typically present for days to weeks. Reported medians vary and are consistently long enough to matter.
That window is the entire defensive opportunity, and it is filled with observable activity: unusual authentication patterns, domain enumeration, new administrative accounts, remote administration tooling appearing on servers, large outbound transfers, backup services stopping.
Most organisations do not see any of it. The reasons are consistent.
Logs exist but nobody looks. Data is collected, retained, and never queried until after an incident.
Alerts fire and are dismissed. The activity generates alerts that blend into a volume nobody can triage.
Legitimate tools are not flagged. Remote administration software is signed and expected. Built-in system utilities are not malware. Detection based on file reputation sees nothing suspicious.
No behavioural baseline. Without knowing what normal authentication and data movement look like, abnormal is unidentifiable.
Segmented visibility. The endpoint team sees endpoints, the network team sees network, the identity team sees authentication, and nobody correlates across all three — which is exactly what the attack requires.
The uncomfortable conclusion is that most ransomware incidents represent a detection failure over weeks rather than a prevention failure in a moment.
Why Exfiltration Changed the Economics
Understanding the operator’s incentives clarifies which defences matter.
Encryption creates urgency and is recoverable with backups. Exfiltration creates permanent leverage. Once data has left, no defensive action retrieves it, and payment buys only a promise from a criminal organisation — a promise with a documented history of not being kept.
This asymmetry means data protection controls now matter more than recovery controls for limiting damage:
Data minimisation. Data you do not retain cannot be stolen. Retention policies actually enforced reduce the impact surface directly.
Encryption at rest with proper key management. Only helps if keys are not accessible from the compromised environment, which is a meaningful constraint on the architecture.
Egress monitoring and control. Large transfers to cloud storage should be visible and, where possible, blocked by default with an allowlist.
Segmentation. Limiting what a compromised host can reach limits what can be aggregated for exfiltration.
Access review. Broad standing access to file shares means one compromised account reaches everything.
Backups remain necessary — they determine whether you recover operationally. They no longer determine whether the incident is damaging.
Detection Opportunities in Order
Ranked by how early they occur and how reliably they indicate a genuine problem:
| Signal | Stage | Reliability |
|---|---|---|
| Authentication from unusual location or impossible travel | Initial access | Moderate |
| Remote admin tooling newly installed on a server | Persistence | High |
| Domain enumeration from a workstation | Discovery | High |
| New account added to privileged groups | Credential access | Very high |
| Lateral authentication in an unusual pattern | Lateral movement | High |
| Endpoint protection disabled or tampered with | Defence evasion | Very high |
| Shadow copies deleted, backup services stopped | Defence evasion | Very high |
| Large outbound transfer to cloud storage | Exfiltration | High |
| Mass file modification | Impact | Certain and too late |
The two very-high-reliability signals in the defence evasion stage deserve specific attention: shadow copy deletion and backup service tampering are near-universal precursors to encryption and are almost never legitimate. An alert on these, routed to someone who will act within minutes, is among the highest-value single detections available.
Domain enumeration from a workstation is similarly valuable. Ordinary users do not enumerate domain trusts or query all domain administrators. This behaviour is highly abnormal and appears early.
Controls Ranked by Actual Effect
Ordered by effect on realistic attack paths per unit of effort:
Multi-factor authentication on every external service. Eliminates the most common initial access vector. Phishing-resistant methods eliminate the relay attack too. Nothing else on this list has a comparable ratio of impact to cost.
Patching internet-facing infrastructure urgently. VPN concentrators, firewalls, file transfer appliances, remote access gateways. These are exploited within days of disclosure and are a primary broker access route.
Offline or immutable backups, tested. Backups reachable from the compromised network get encrypted alongside everything else. Immutability and network isolation are what make them survive. Untested backups are an assumption, not a control.
Least privilege on administrative accounts. Separate administrative credentials, no domain administrator for daily work, just-in-time elevation. This is what limits lateral movement.
Network segmentation. Flat networks let one compromised host reach everything. Segmentation converts a full compromise into a contained one.
Endpoint detection with behavioural rules and someone watching. Tooling without monitoring produces alerts nobody reads. The monitoring is the control, not the product.
Egress restriction. Default-deny outbound with an allowlist makes exfiltration substantially harder.
Application control on servers. Servers run known software. Blocking unauthorised executables stops much of the tooling operators rely on.
Phishing-resistant authentication for administrators. The accounts that matter most deserve the strongest protection available.
What Recovery Actually Requires
If it happens, the operational sequence matters and the priorities are counterintuitive.
Preserve evidence before remediating. Memory images and logs before rebuilding. Wiping machines destroys the information needed to determine scope, and scope determines your notification obligations.
Contain by network isolation, not by shutdown. Powering off destroys volatile evidence. Isolating preserves it while stopping spread.
Assume identity compromise. Rotate credentials comprehensively, including service accounts and certificates. Rebuilding systems while leaving the credentials that were stolen achieves little.
Determine what left before deciding about payment. Exfiltration scope drives notification requirements and legal exposure. This is the question that matters most and takes longest to answer.
Rebuild rather than clean. Persistence mechanisms are difficult to find exhaustively. Rebuilding from known-good images is more reliable than removal.
Engage legal and specialist response early. Notification timelines are short, jurisdiction-dependent, and unforgiving. Sanctions considerations may apply to payment.
On the payment question, the honest position is that it is a business decision with no good options. Payment funds the ecosystem, may be legally restricted, and provides only a promise. Non-payment may mean publication. Anyone claiming a universal answer is not accounting for the range of circumstances organisations face.
Common Pitfalls
Treating backups as the complete answer. They address availability. They do nothing about stolen data.
Multi-factor authentication with exceptions. One service without it is the way in. Legacy protocols that bypass it are the same problem.
Backups reachable from the production network. They will be encrypted with everything else.
Untested restores. A backup you have never restored is an assumption.
Tooling without monitoring. Alerts nobody reads are not detection.
Flat networks. Convert every compromise into a total compromise.
Shutting down machines during response. Destroys the evidence needed to scope the incident.
Conclusion
Ransomware is now a data theft crime with an encryption component, and frequently without one. The extortion leverage comes from information the operator holds, which no recovery process addresses.
Defensively, this shifts emphasis. Multi-factor authentication everywhere and urgent patching of internet-facing infrastructure close the common entry routes. Least privilege and segmentation limit what a foothold becomes. Egress control and data minimisation reduce what can be taken. Immutable, tested, isolated backups determine whether you recover operationally.
And detection matters more than any single preventive control, because operators are present for weeks doing observable things. Alerting on shadow copy deletion, backup service tampering, privileged group changes, and domain enumeration from workstations — with someone available to act — is where the realistic opportunity to interrupt an attack in progress lives.
Frequently Asked Questions
Do good backups still matter? Yes, for operational recovery. They no longer prevent the incident from being damaging, because stolen data is unaffected by restoration. Necessary, not sufficient.
How long are attackers typically present before encryption? Days to weeks, varying by group and target. Long enough that detection during the intrusion is realistic, which is where defensive investment produces the most value.
Is paying the ransom ever the right decision? It is a business and legal decision with no good options. Payment funds the ecosystem, may be legally restricted depending on the actor, and buys only a promise. Organisations facing publication of sensitive data sometimes conclude otherwise, and that judgement depends on specifics.
What is the single most effective control? Phishing-resistant multi-factor authentication on all external access. It closes the most common initial access vector and cannot be defeated by credential theft or relay.
Does cyber insurance help? It funds response and recovery, which has real value. It does not prevent incidents, policies increasingly require specific controls to be in place, and coverage for extortion payments varies considerably.
How can exfiltration be detected? Egress monitoring for volume anomalies and destinations, particularly cloud storage and file-sharing services. Default-deny outbound with an allowlist is more effective than detection alone.
Are small organisations actually targeted? Yes. Access is purchased opportunistically rather than selected strategically, and smaller organisations frequently have weaker controls with meaningful data. Being small is not a defence.
