How it works
Operators gain access, escalate privilege, map the estate, disable defences and delete backups, then act on many systems at once. Whether the ending is encryption, publication of stolen data, or irreversible destruction is a choice made at the last step.
The payload is the last five minutes
Ransomware is discussed as a malware problem and is better understood as an intrusion problem with a loud ending. By the time files begin encrypting, the operator has typically been inside for days or weeks — obtaining access, escalating privilege, learning the estate, identifying backups and disabling anything that would interrupt them.
That sequence is where defence actually happens. Detection tuned to the encryption event is detection that fires when the outcome is already determined; every meaningful opportunity sat earlier, in activity that looked like administration.
It also explains why "do you have backups" is the wrong question. Operators target backups deliberately, because a victim who can restore does not pay. Backups reachable with the same credentials that reached production are not a recovery plan.
Extortion moved before the encryption
Encryption alone became less effective as recovery improved, so operators added data theft. Records are staged and exfiltrated before anything is encrypted, giving leverage that survives a perfect restore: you can recover your systems and still face publication of your data.
This changes the incident materially. A restorable outage is an operational problem; a confirmed data breach carries notification duties, regulatory exposure and customer consequences that no backup addresses. Organisations that had rehearsed recovery frequently discover the recovery was never the hard part.
The practical consequence for detection is that the best warning is outbound rather than local. Bulk reads, archive creation, and large transfers to cloud storage or file-sharing services precede impact and are visible if anyone is watching egress.
When destruction is the objective
Some intrusions never intend recovery. Wiper malware destroys data or boot structures outright, and is frequently disguised as ransomware — a ransom note is displayed, but no usable key exists and payment changes nothing.
The distinction matters during response. Treating destruction as encryption wastes the early hours negotiating or hunting for a decryptor that was never generated, while the actual task is invoking recovery.
Signals that separate them: boot structures altered rather than files encrypted, recovery tooling and backups targeted first, and destruction occurring simultaneously rather than progressively. Encryption for profit tends to leave the environment recoverable enough to demonstrate a decryptor; destruction does not.
What actually reduces impact
The controls that change outcomes are unglamorous and mostly architectural.
- Backups that are offline or immutable, held in a different trust domain, with restores tested — a backup nobody has restored is a hypothesis.
- Segmentation, so credentials from one host do not open the estate. Flat networks turn a single compromise into a total one.
- MFA on every remote access path, including the legacy one someone kept for a vendor.
- Tier-zero treatment for backup and directory administration identities; these are the accounts operators hunt for first.
- Egress visibility, because the theft that creates the leverage happens before the encryption that creates the alarm.
- A rehearsed recovery plan assuming the network is hostile and the directory is untrustworthy — recovering into a compromised environment reinfects it.
Also known as
What defenders may observe
- Mass file modification or encryption across many hosts
- Backup jobs failing, or backup and security tooling disabled
- Lateral administrative activity in the days before impact
- Large outbound transfers or archive staging preceding the event
- Volume shadow copies and recovery points deleted
- Extortion messages referencing specific stolen records
Prevention and mitigation
- Keep offline or immutable backups and test restores, not just backup jobs
- Require MFA on every remote access and administrative path
- Segment the network so one compromised host cannot reach everything
- Protect backup and data-administration identities as tier-zero assets
- Monitor egress for staging and bulk transfer, not only for malware
- Rehearse recovery from golden images with the network assumed hostile
Initial response priorities
- Isolate affected systems without destroying volatile evidence.
- Activate the incident-response and continuity plans.
- Scope initial access, persistence, lateral movement and affected identities before recovery.
Use your approved incident-response plan and adapt decisions to your environment. This is educational guidance, not a substitute for live incident leadership.