The ransomware process is a complex, multi-stage journey that can take weeks. Learning to recognize the behaviors that make up each step is essential for distinguishing normal administrative activity from shady activity masquerading as such.

1. Initial access

Rather than attempting to break in through time-consuming technical exploits or noisy brute-force attacks, threat actors are increasingly focusing on logging in using valid credentials. Social engineering remains a go-to for initial access, while “AI is increasingly being used to craft highly convincing, hyper-personalized phishing messages.

In other cases, attackers purchase stolen credentials on the dark web. If a remote access tool, such as Remote Desktop Protocol (RDP), is exposed directly to the internet without a VPN or multi-factor authentication (MFA), an attacker with stolen credentials can access that endpoint with ease.

2. Defense evasion

Once attackers are inside, they work to make sure they aren’t discovered. They do this by hijacking legitimate system tools (e.g., Windows Management Instrumentation [WMI], PowerShell) and injecting malicious code into legitimate running processes. This approach, known as living off the land (LotL), disguises hacker activity (disabling detection tools, clearing system logs) as legitimate activity.

Another sophisticated approach is "bring your own vulnerable driver" (BYOVD), in which attackers drop and load a legitimate, digitally signed driver with a known security flaw. They exploit this vulnerability to disable EDR, hide their activity, and harvest credentials.

3. Persistence

To ensure long-term access even after a system reboot, attackers use persistence mechanisms. They will often inject malicious scripts into scheduled tasks or modify registry “Run” keys to execute malware every time a user logs in. They may also create new admin accounts in case their primary credentials are revoked.

4. Privilege escalation

An attacker’s initial point of access will often have limited, user-level permissions. To move throughout the network and access sensitive servers, they must escalate their privileges to administrator or SYSTEM levels. They do this by using tools like Mimikatz to harvest the credentials of every user who has recently logged into that machine. If they fully compromise the Domain Controller, they can use Active Directory (AD) to get the "keys to the kingdom."

5. Discovery and lateral movement

Once an attacker has admin rights, they can map the environment to identify high-value targets like backup servers, financial databases, and sensitive intellectual property. They move laterally across the network using Server Message Block (SMB) or RDP to blend in with normal traffic.

6. Data staging and exfiltration

In most modern attacks, attackers quietly exfiltrate sensitive data before encrypting it, enabling double extortion if the victim has reliable backups. Before exfiltrating data, attackers will move it to a central staging area for compression. From there, they can upload it to the cloud or their own servers.

7. Encryption and impact

Since encryption is the most visible stage of a ransomware attack, threat actors will often wait until after business hours or during holidays to launch payloads. This capitalizes on the fact that many organizations’ IT and security teams will be offline or short-staffed during those windows.

Before deploying encryption, attackers often delete local backups so victims can’t easily restore their data. They will then encrypt files and drop the ransom note demanding payment in exchange for the decryption key and a promise not to leak the stolen data.

The unfortunate truth about ransomware attacks is that the signs of the initial breach and pre-encryption activity are often present in logs for weeks but are lost in the noise of routine operations.

Suspicious admin activity treated as routine

Because attackers “live off the land,” their activity can look like an IT administrator’s. A busy IT team might dismiss a login from an unusual IP address if it uses a valid admin account. If their tools aren’t configured properly, they can miss subsequent activity, such as the clearing of logs.

Lack of visibility across endpoint and identity signals

Not having a unified security stack can create visibility gaps that attackers exploit. On the other hand, an integrated stack that includes a tool like security information and event management (SIEM) can correlate signals from across the environment, connecting the dots between signals that might otherwise be treated as low-priority, isolated activity. In larger organizations, security teams can also create gaps by operating in silos, with the “identity team” and the “endpoint team” not coordinating their efforts.

Overconfidence in backups alone

Backups are an essential part of a layered ransomware defense. While backups help organizations recover should the worst happen, they aren’t a bulletproof solution. Modern attackers specifically hunt for and delete backup files before encrypting data. Following the 3-2-1 backup rule can guard against this; however, it won’t stop attackers from stealing and threatening to leak data or extort employees and partners.

Abuse of legit tools

Traditional antivirus (AV) is an essential first layer of defense, but it focuses on known malware and is often blind to techniques like LotL. To catch more sophisticated actors using polymorphic, custom, or fileless malware, organizations need to monitor behaviors (e.g., a PDF reader launching PowerShell). This requires a tool like endpoint detection and response (EDR).

The key to defending against ransomware is to transition from a strategy focused solely on prevention to one built on resilience and rapid containment.

Reduce initial access paths

Start by addressing the most common vulnerabilities. In today’s decentralized IT environment, identity is the new perimeter. Harden external-facing accounts by enforcing MFA everywhere. Identity security posture management (ISPM) can also monitor for identity-related risks like misconfigurations and dormant accounts.

Since vulnerability exploitation is on the rise, organizations should adopt an aggressive patching cadence for perimeter devices (VPNs, firewalls, etc.) as well as endpoints. Endpoint security posture management (ESPM) enables control of which apps are allowed and blocked, and exposes missing security patches and risky configurations.

With the “human element” playing a role in 60% of breaches, ongoing managed security awareness training (SAT) is essential for addressing employee phishing susceptibility.

Detect lateral movement quickly

Reducing dwell time is the primary goal for ransomware defense. The median dwell time for attacks that aren’t revealed by the threat actor is 24 days. During that time, attackers are zeroing in on high-value data for exfiltration and encryption. Security teams should aim to shrink that window from days to minutes by adopting behavior-monitoring tools like EDR that can flag unusual patterns, such as credential dumping and network scanning.

Maintain continuous monitoring

Continuous monitoring across the environment is non-negotiable. A SIEM acts as the central command center, bringing together logs from across the organization to provide a unified picture. This enables correlation between subtle signals to catch “hands-on-keyboard” attacks that individual tools might miss. It also ensures that a forensic trail is preserved if the logs roll over or an attacker clears logs on an endpoint, application, or network device.

Automated tools can only do so much. Sophisticated human attackers require human defenders for effective detection and response. A 24/7 security operations center (SOC) ensures that security experts are ready to rapidly investigate, contain, and remediate threats, no matter when they strike.

Huntress is a unified platform designed to help defend across every stage of the ransomware lifecycle. Unlike purely automated software that human attackers can bypass, Huntress comes backed by a 24/7 team of experts to detect and contain threats early.

• Managed ISPM & ESPM continuously monitor identities and endpoints for weaknesses and exposure so you can correct them before attackers find them.

• Managed EDR monitors for behavioral anomalies to detect living-off-the-land and other sophisticated techniques, allowing for rapid detection and containment.

• Managed ITDR monitors cloud and on-prem accounts for credential abuse or unusual privilege escalation, and enables automatic account disabling.

• Managed SIEM correlates telemetry from across the environment to reveal complex attack chains. Reduce false positives and alert fatigue with smart filtering that captures only security-relevant data.

• Managed SAT turns employees into a first line of defense with training built on real-world threat intelligence and adult learning models. Our SAT uses engaging, story-driven content to ensure high retention and measurable risk reduction.