Netwalker's primary goal was simple: make a boatload of money. They accomplished this through a highly effective RaaS model, focusing on "big game hunting"—targeting large organizations that could afford massive ransoms. Their main tactics involved initial access, data exfiltration, and double extortion to maximize pressure on victims.

To get inside a network, Netwalker affiliates used several techniques. They often exploited unpatched software and weak credentials, particularly targeting vulnerabilities in VPN appliances like Pulse Secure VPN and web applications using Telerik UI. Once inside, they used tools like Cobalt Strike and PowerShell scripts to move laterally, escalate privileges, and avoid detection. To cover their tracks and prevent recovery, they deleted shadow volume copies using vssadmin or WMI commands.

The attack chain typically started with a phishing email or by exploiting a public-facing application. A common method involved COVID-19-themed phishing campaigns that tricked users into opening malicious attachments. Once initial access was gained, the attackers deployed PowerShell-based malware that executed in memory. They also used process hollowing to inject their malicious payload into legitimate processes like explorer.exe, making it harder to spot. After exfiltrating data, the ransomware would encrypt files across the network, leaving behind a ransom note in each folder.