Ransomware is malicious software or part of a broader intrusion that can lock systems, disrupt operations, steal data, or all three to pressure a victim into paying. Modern attacks often involve data theft and extortion even when encryption is limited or fails.

According to CISA, common entry points include internet-facing vulnerabilities and misconfigurations; including exposed Remote Desktop Protocol (RDP) and virtual private networks (VPNs), phishing, precursor malware infections, and compromised third parties like managed service providers (MSPs). Stolen and brute-forced credentials are often in the mix.

Ransomware often leaves early warning signs before the final payload drops: anomalous VPN logins, newly escalated accounts, suspicious PowerShell activity, unexpected remote monitoring and management (RMM) tools, shadow copy tampering, and signs of data exfiltration.

That’s why prevention alone isn’t enough. You need to catch attacker behavior earlier in the chain, before encryption, lateral movement, and extortion do the real damage.

1. Keep encrypted backups and test them.

Keep multiple copies of critical data, with at least one offline or logically isolated. Encrypt them, limit who can delete them, and run restore tests on a schedule. Quick vocabulary: offline means disconnected, isolated means separated from production networks and credentials, and immutable means it can’t be changed for a set period. Each helps. None replaces testing.

2. Patch internet-facing systems first.

Unpatched VPNs, firewalls, and remote access tools stay on attacker wish lists for a reason. Prioritize known exploited vulnerabilities, then work down the list. Patching is essential, but it isn’t a complete defense.

3. Lock down RDP and remote access.

Don’t expose RDP to the public internet. If you need remote access, put it behind a VPN or zero-trust gateway, require multifactor authentication (MFA), restrict who can connect from where, and monitor authentication logs. Turn off what you don’t use.

4. Train employees to spot phishing and social engineering.

Phishing is one of the most common ways in. Security awareness training (SAT) helps people catch suspicious links, fake urgency, and impersonation before they become an attacker’s foothold.

5. Use application allowlisting.

If unapproved tools can’t run, attackers have fewer ways to drop payloads and abuse legitimate software. It’s especially useful against loaders, rogue binaries, and unauthorized remote access tools.

6. Segment your network.

Flat networks make attackers faster. Segmentation helps keep one compromised system from becoming an organization-wide outage.

7. Require phishing-resistant MFA.

Prioritize email, VPN, remote access, and privileged accounts. Standard MFA isn’t enough: in the EvilTokens campaign, victims completed MFA correctly and still gave attackers a valid session. If a system can’t support phishing-resistant MFA yet, document the workaround and plan the migration.

8. Watch for suspicious PowerShell, WMI, and script activity.

Attackers often live off the land, which means they use tools already on your systems, like PowerShell and Windows Management Instrumentation (WMI). That makes malicious activity look like routine admin work. Monitoring for unusual scripting and native tool use helps you catch attackers sooner.

9. Add behavioral endpoint detection with 24/7 monitoring.

Endpoint detection and response (EDR) shows you what’s happening on your endpoints, and behavioral detection flags suspicious patterns as they unfold. But round-the-clock monitoring only helps if someone’s there to act at 2am. Look for managed EDR that pairs detection with SOC analysts who investigate and respond, and ask exactly what coverage and response you get.

10. Build and test an incident response (IR) plan.

Define isolation steps, owners, recovery decisions, communications, and escalation paths before a real incident forces the issue. Then run it. A plan that’s never been tested has gaps you’ll only find at the worst moment. Gather the people who’d actually be in the room for a tabletop exercise, and turn every hesitation or disagreement into a fix. Our Incident Response Tabletop-in-a-Box gives you a ready-to-run scenario, facilitator notes, and defined roles and decision points, no outside consultant needed.

No single tool stops ransomware on its own. Layers do different jobs.

Antivirus is a solid baseline. Signature-only detection can miss new variants and attackers who use legitimate tools, though many modern products add behavioral and cloud-based detection. Check what yours actually includes.

EDR adds telemetry, investigation, and containment, so you can see what’s happening on an endpoint, not just whether a file matches a known bad hash. How well it works depends on coverage, configuration, and who responds.

Behavioral detection looks for attacker behavior like credential theft, mass file access, shadow copy deletion, unusual scripting, suspicious remote tooling, and lateral movement.

Antivirus helps block what’s known. Behavioral detection helps you spot suspicious activity as it unfolds.

Pre-encryption activity can include mass file access, attempts to disable recovery controls, suspicious PowerShell or WMI execution, credential abuse, unusual remote access behavior, and signs of data exfiltration.

Huntress has also documented ransomware activity tied to real-world groups like Akira, Qilin, and emerging variants such as Crux, along with tradecraft like RClone abuse, RDP access, rogue RMM activity, and efforts to disable recovery features before impact.

These are the signals that matter because they tell you an attacker is active before encryption begins.

1. Isolate affected systems immediately. Disconnect infected devices from the network, disable compromised accounts, and stop the spread before it gets worse.
2. Do not pay the ransom. Payment does not guarantee decryption, and it rewards the cybercriminals who caused the damage in the first place.
3. Assess scope. Identify which systems were impacted, what data may have been accessed or exfiltrated, and whether the attacker still has persistence in the environment.

Then begin recovery from clean backups if they are available, follow a structured ransomware recovery guide to restore systems safely and reduce the risk of reinfection, and use this guide on how to remove ransomware if you need step-by-step remediation help.

The best way to protect against ransomware is not a single product or a single checklist item. It is a layered security strategy that combines backups, patching, access controls, user training, and behavioral monitoring with a 24/7 response capability.

Huntress Managed EDR is built to catch the activity that prevention-only tools can miss, then pair that visibility with 24/7 AI-centric Security Operations Center (SOC) investigation and response.

That matters for lean IT and security teams that need enterprise ransomware protection without having to chase every alert or build a full in-house SOC. With analyst-backed response and fast containment, Huntress is designed to help teams catch ransomware tradecraft before it turns into downtime, data loss, and a long recovery cycle.