CyphrQ
Menu

How Ransomware Attacks Work, and the Controls That Stop Them

How ransomware attacks unfold, from first access to encryption and extortion, and the backup, identity and patching controls that break the chain.

By CyphrQ.ai

Written with AI assistance and human editorial review. Every figure linked to its source.

11 min read

How do ransomware attacks work? In stages: the attacker gets in, steals credentials, copies your data, destroys your backups, and only then encrypts files and demands payment. The controls that stop them are the unglamorous ones: offline, tested backups, phishing-resistant sign-in, patched internet-facing systems, and alerts on the moves that come before encryption.

Ransomware is malicious software that locks your files, or threatens to publish them, until you pay. The encryption is the last step of a longer operation, and that is good news: every earlier step is a chance to stop it.

How do ransomware attacks work, from first access to ransom note?

Most write-ups start with the ransom note. The attackers' work starts days or weeks earlier. The six-stage order below is our own synthesis, not a sequence published by CISA. CISA's #StopRansomware Guide lists entry routes and prevention rather than a stage-by-stage chain, though it does say that ransomware deployment is the last step in a network compromise. We built the stages from that guide and from two joint advisories on named ransomware groups (Akira and Medusa), linked further down.

  1. Initial access. The attacker finds one way in. CISA's guide lists six: internet-facing vulnerabilities and misconfigurations, compromised credentials, phishing, precursor malware infections, advanced social engineering, and third parties or managed service providers.
  2. Quiet exploration. They log what is on the network, using ordinary administration tools so that little looks unusual.
  3. Credential theft and spread. They collect passwords and move from the first machine to servers and the systems that manage everything else.
  4. Data theft. They copy sensitive files out to storage they control. This is what makes the extortion work even if you can restore.
  5. Recovery destruction. They delete shadow copies, backup catalogues and, where reachable, the backups themselves.
  6. Encryption and the demand. Files are encrypted across many machines at once, and a note appears. The attackers have pressured victims to pay by threatening to release the stolen data as well.

Steps 2 to 5 are the window. Encryption is loud. The earlier steps are quiet, and they are where well-run organisations catch attacks.

What are the main ways ransomware gets into a business?

The CISA guide does not rank its six entry routes, and neither will we. What matters for a small or mid-sized business is that three of them are about identity and exposure rather than clever malware:

  • Internet-facing systems that are unpatched or misconfigured. A remote access gateway, a VPN, a file-transfer tool, a remote desktop service open to the internet. The attacker does not need your staff to do anything.
  • Compromised credentials. A password that was reused, guessed or bought, used on a service with no second factor.
  • Phishing. A convincing message that gets someone to hand over a password or run a file. The lures are now fluent and personal; that is covered in AI phishing protection for small business, so we won't repeat it here.

The other three routes matter too. A precursor malware infection is an earlier, separate infection that gives attackers a foothold. Third parties and managed service providers matter because their access to you is part of your exposure.

What do real ransomware advisories show about how groups operate?

Two joint advisories, written by CISA and partner agencies from incident response and investigations, give a concrete picture.

Akira. CISA's #StopRansomware: Akira Ransomware advisory (AA24-109A), first published on 18 April 2024 and last revised on 13 November 2025, says that as of late September 2025 Akira ransomware "has claimed approximately $244.17 million (USD) in ransomware proceeds". The advisory describes entry through VPN services without multi-factor authentication, exploitation of known vulnerabilities in VPN and backup software, password spraying, spearphishing, and valid accounts used over remote services such as RDP. The encryptor also deletes Volume Shadow Copy Service copies, Windows' built-in file snapshots.

Medusa. CISA's #StopRansomware: Medusa Ransomware advisory (AA25-071A), first published on 12 March 2025 and last updated on 18 August 2026, says that as of April 2026 Medusa actors had "impacted over 500 victims from a variety of critical infrastructure sectors", including medical, education, legal, insurance, technology and manufacturing organisations. It lists phishing campaigns as a primary method for stealing credentials, plus unpatched software and purchased access from initial access brokers. Victims are pressured through a leak site with countdown timers, direct contact by phone or email, and a threat to sell the stolen data.

Look at what the two have in common. Neither relies on a zero-day exploit nobody can defend against. Both rely on a missing second factor, an unpatched edge device, or a stolen login, and both go after recovery before they encrypt. The mitigation lists in both advisories overlap heavily: patch exploited vulnerabilities first, require MFA (Medusa's says phishing-resistant), segment the network, and keep offline, encrypted, immutable backups that you have tested.

Why do backups fail against ransomware, and what makes them ransomware-proof?

Backups fail for a boring reason: the attacker can reach them. CISA's guide says many ransomware variants "attempt to find and subsequently delete or encrypt accessible backups". If your backup drive is mounted on the file server, or your backup console uses the same admin account as everything else, it is part of the target.

CISA's prevention advice is to maintain offline, encrypted backups of critical data and to test their availability and integrity regularly in a disaster recovery scenario. The Akira and Medusa advisories add that backups should be immutable, meaning they cannot be changed or deleted for a set period, even by an administrator.

A backup plan that survives ransomware has four properties:

Property What it means in practice Failure it prevents
Separate At least one copy sits where a stolen admin login cannot reach it Attacker deletes or encrypts every copy
Immutable or offline The copy cannot be altered for a retention period Attacker uses backup software to wipe history
Tested You have restored a real system from it, and timed it Discovering the backup is incomplete during the incident
Prioritised You know which systems come back first and what depends on what Restoring in the wrong order and losing days

Backups restore your files. They do not undo the data theft, which is why backups alone do not end a modern ransomware incident.

Which ransomware controls give the most protection for the least effort?

The controls below draw on the prevention list in CISA's guide. The order is our own judgement of effort against protection; CISA's list is not ranked.

  1. Phishing-resistant sign-in on everything exposed. Passkeys or security keys, first for email, VPN and remote access, admin accounts and the backup console. CISA's guide says to "implement phishing-resistant MFA for all services", particularly for email, VPNs and accounts that access critical systems, and to require unique passwords of at least 15 characters.
  2. Patch the edge first. Anything reachable from the internet gets patched promptly. Do not expose services such as RDP directly to the web, and keep VPNs patched. Ask your IT partner for a list of every internet-facing system you own.
  3. Separate admin accounts from daily accounts. Apply least privilege, so one stolen login cannot reach everything.
  4. Offline, encrypted, immutable, tested backups, as above.
  5. Endpoint detection and response (EDR) and application allowlisting. EDR is security software that watches what programs do on a computer, not just what they look like. Allowlisting means only approved programs may run.
  6. Email filtering and DMARC, with risky attachment types restricted and macros in emailed Office files disabled.
  7. A written, rehearsed response plan. Decide in advance who calls the insurer, the lawyer and the authorities, and who has authority to take systems offline.

If you can only do three this quarter, pick the first, second and fourth.

What should you do in the first hour of a ransomware incident?

In the first hour: contain the spread, protect your backups, call your incident response contact and your insurer, and do not decide on payment yet.

Have the answers before you need them. CISA's response checklist runs in four phases: detection and analysis, reporting and notification, containment and eradication, recovery and post-incident activity. This is our reading of how to prepare for the first hour; the guide has the full checklist.

  • Contain. Decide in advance who may take systems off the network, and how, so that nobody waits for permission while encryption spreads.
  • Protect the backups. Check straight away whether backup systems are intact, and cut them off from the network.
  • Call your incident response contact and your insurer, and report to your national authority. Keep the phone numbers on paper, because email and your directory may be down.
  • Do not decide on payment in the first hour. The CISA guide describes how the extortion model works but does not tell you whether to pay. Make that decision with legal and insurance advice, and remember that paying does not remove the copy of your data the attackers hold.

What does a one-quarter ransomware readiness plan look like?

  1. Weeks 1-2: inventory and exposure. List every internet-facing system, remote access method and account that can administer backups. Close what is not needed.
  2. Weeks 3-4: identity. Phishing-resistant sign-in for admins, remote access and email. Remove shared admin accounts.
  3. Weeks 5-8: backups. Create the separate, immutable copy. Do a restore of one real system and time it.
  4. Weeks 9-10: detection. Make sure EDR is on every server and workstation, with someone reading its alerts.
  5. Weeks 11-12: rehearse. A two-hour tabletop exercise with the owner, IT, finance and whoever speaks to customers: it is Tuesday, files are encrypted, and the attacker says they hold your customer data. What happens next?

Going deeper: for security and IT teams

Mapping to MITRE ATT&CK. The two techniques that define the end of the chain are T1486 Data Encrypted for Impact and T1490 Inhibit System Recovery, both in the Impact tactic (TA0040). T1486 has no sub-techniques and lists mitigations M1040 (Behavior Prevention on Endpoint) and M1053 (Data Backup). T1490 lists M1053, M1038 (Execution Prevention), M1028 (Operating System Configuration) and M1018 (User Account Management). Both pages were last modified on 12 May 2026 when we read them.

Detect before you encrypt. T1490 documents native Windows utilities used to remove recovery data: vssadmin.exe deletes volume shadow copies, bcdedit.exe disables automatic recovery by changing boot configuration data, and wbadmin.exe deletes the Windows Backup Catalog. MITRE's detection strategy DET0329 covers these, along with wmic, REAgentC.exe and diskshadow.exe, as process chains with arguments that delete shadow copies, disable recovery or remove backup catalogues (AN0933). The same page has analytics for ESXi shell or vim-cmd activity that deletes all virtual machine snapshots (AN0935) and for cloud API calls that disable snapshot schedules, backup policies or versioning before deleting snapshots (AN0937). Akira's encryptor, per the advisory, deletes shadow copies through PowerShell by removing Win32_Shadowcopy objects, so command-line logging that captures PowerShell and WMI activity matters as much as watching vssadmin.

Detect encryption itself. MITRE's DET0215 lists analytics for high-frequency file writes using uncommon extensions followed by ransom notes, registry tampering or shadow copy deletion (AN0602), encryption of virtual machine files in VMFS datastores (AN0605) and encryption of cloud storage objects (AN0606). If you run VMware ESXi, put the hypervisor in scope for logging; many EDR deployments never reach it.

Initial access and the edge. The Akira advisory names CVE-2020-3259 and CVE-2023-20269 (VPN products), SonicWall CVE-2024-40766, and Veeam Backup and Replication CVE-2023-27532 and CVE-2024-40711. Medusa's advisory lists CVE-2024-1709 (ScreenConnect), CVE-2023-48788 (Fortinet EMS), CVE-2025-10035 (Fortra GoAnywhere) and CVE-2026-1731 (BeyondTrust). Your backup server and remote support tools are in the same risk class as your VPN. Check each against your own asset list.

Hardening settings the CISA guide names. Disable SMBv1 and move to SMBv3. Block TCP 445 and 137-139 at the perimeter. Retain logs for critical systems for at least one year where possible. Use centrally managed antivirus and EDR with application allowlisting, and separate admin and user accounts. The Akira advisory adds time-limited, just-in-time admin access, and maps its backup advice to CISA's Cross-Sector Cybersecurity Performance Goals: 2.R (offline backups), 2.K (test restoration) and 2.L (encrypted, immutable backups).

Lateral movement and exfiltration signals. The advisories name tools you can baseline against your own estate: remote access software such as AnyDesk, ConnectWise, Atera and Splashtop, PsExec, Rclone to cloud storage, WinSCP, and tunnelling through Cloudflared or Ngrok. Alert on any of them appearing on a server where they are not approved, and on Rclone in a Defender-excluded folder, which Medusa actors have used.

Test that it works. Run a quarterly restore of a tier-one system into an isolated network and record the time against your recovery objective. Try to delete a backup using a domain admin account. If it succeeds, the backup is not immutable. Check that your EDR raises an alert when a test host runs a benign shadow-copy listing.

Ask your team or provider: Which backups can a compromised domain admin reach? Who reads EDR alerts at 3 a.m.? When did we last restore a full system, and how long did it take? Which internet-facing systems are not on the asset list?

Key takeaways

  • Ransomware is an operation in stages. Encryption comes last, after access, credential theft, data theft and the destruction of backups.
  • CISA lists six common entry routes. The advisories on Akira and Medusa show the same three weaknesses: missing MFA, unpatched edge devices and stolen credentials.
  • Akira had claimed approximately $244.17 million in proceeds as of late September 2025 (CISA). Medusa had impacted over 500 victims as of April 2026 (CISA).
  • Backups only help if an attacker with admin access cannot reach them. Keep them offline or immutable, encrypted, and restore-tested.
  • Backups do not undo data theft, so detection and access control matter as much as recovery.
  • If you do three things: phishing-resistant sign-in, patching internet-facing systems first, and a tested offline backup.
  • For IT teams: alert on T1490 behaviours (vssadmin, bcdedit, wbadmin, PowerShell shadow copy removal, ESXi snapshot deletion) and put hypervisors, backup servers and remote support tools in scope.

Sources