Most people picture ransomware as a moment: someone clicks, the screen goes red, a countdown appears. The reality is slower and, frankly, more unsettling. By the time the note appears, the attackers have usually been inside for days or weeks. Here is the sequence, step by step, and where it can be broken.
1. Getting in
A phishing email, a stolen password used on a remote-access system without multi-factor authentication, or an unpatched device on the edge of the network. Nothing dramatic happens. Someone now has a foothold on one machine.
2. Looking around
The intruder maps the network: which servers matter, where the backups are, who the administrators are. They use ordinary tools — the same ones an IT person uses — so nothing looks like malware. This stage can last weeks.
3. Taking the keys
Administrator credentials are harvested. Once they have those, the intruder can go anywhere — including, crucially, to the backups, which they will try to delete or encrypt first so that you have nothing to restore from.
4. Taking a copy
Before encrypting anything, modern groups exfiltrate data — customer records, financials, patient files — so that "pay or we publish" becomes a second lever even if you can restore. For a healthcare or professional-services business, this is often the worse half.
5. The note
Only now, usually on a Friday night or a holiday weekend, does the encryption run. Everything at once, so that by the time anyone notices, it is done.
Breaking the chain
Every step has a counter. MFA and email filtering make step one harder. Endpoint detection and network segmentation make the "looking around" noisy — a workstation scanning the network at 3 a.m. is exactly the behaviour those tools flag, and our monitoring team gets the alert. Least-privilege administration limits step three. And isolated, immutable backups — copies the intruder cannot reach even with admin rights — break step five entirely: you restore, they get nothing.
The quiet reassurance
When we build an environment, we assume steps one and two might happen to anyone, and design so that steps three, four and five cannot succeed. That is the difference between a bad week and a closed business. We restore-test those backups on a schedule for exactly this reason: a recovery plan is only real once it has been rehearsed.
