Learn With Examples
It almost never starts with a hacker in a hoodie breaking down a digital door. It starts with one password, one unpatched server, or one convincing email — and by the time the ransom note appears, the attackers have often been inside for weeks.
Picture a Friday afternoon at a mid-sized logistics company. An accounts clerk gets an email that looks like an unpaid invoice from a supplier she deals with weekly. She opens the attachment. Nothing visibly happens, so she carries on with her day and goes home.
Nineteen days later, at 2:14 on a Sunday morning, every file server in the company locks simultaneously. Spreadsheets, delivery schedules, the customer database, even the backups on the network drive — all replaced with scrambled files and a text document explaining where to send the Bitcoin.
Those nineteen days are the part almost nobody pictures. Ransomware is not a bomb that goes off when you click. It is a burglary that ends with the locks being changed — and the burglary itself takes days or weeks, during which the intruders are quietly reading your email, finding your backups, and stealing your data before a single file is ever encrypted.
This article explains what actually happens in those weeks, how the infection gets in, and what five of the most damaging real-world attacks teach us. Everything here is defensive knowledge: how the attack chain works, so you can recognise and break it.
What ransomware is
Ransomware is malicious software that makes your data unusable and sells it back to you. It scrambles your files with strong encryption, and the key needed to unscramble them is held by the attacker until you pay. Modern attacks add a second lever: before encrypting anything, they copy your sensitive data out and threaten to publish it. So even a company with perfect backups still faces a leak.
The important part for defenders: encryption is the last step. Everything before it — the break-in, the spread, the theft — is where an attack can still be stopped.
Why it stopped being about locked files
Early ransomware was crude and indiscriminate: infect as many home computers as possible, demand a few hundred dollars each, hope enough people pay. Then criminals noticed that a hospital or a factory will pay vastly more than a thousand individuals, and the whole model changed.
- 2013 — 2015 · SPRAY AND PRAYMass email campaigns hitting individuals for a few hundred dollars. Good backups were a complete defence.
- 2016 — 2018 · BIG GAME HUNTINGAttackers begin targeting organisations deliberately, studying revenue and pricing the ransom to fit. Demands jump into six and seven figures.
- 2019 · DOUBLE EXTORTIONThe pivotal change: steal the data first, then encrypt. Now backups alone don’t save you — refusing to pay means your customers’ data gets published.
- 2020 onwards · RANSOMWARE AS A SERVICEThe criminal ecosystem specialises. One group writes the software, others break into networks, others negotiate. You no longer need technical skill to run an attack.
- 2023 onwards · EXTORTION WITHOUT ENCRYPTIONSome groups skip the encryption entirely. Stealing the data and threatening to leak it is quieter, faster, and often just as profitable.
That progression matters because it changes what “being prepared” means. Backups answer the 2015 problem. They do nothing about the 2019 one. A company today needs to survive both losing access to its data and having that data published.
The attack chain, stage by stage
Nearly every serious ransomware incident follows the same six stages. Tap through them — each stage is a place where the attack could still be caught, and knowing that is the entire point of learning the sequence.
The six stages
tap a stageGetting through the front door
Three routes account for the overwhelming majority of break-ins: a stolen or guessed password on a remote access system without multi-factor authentication, an unpatched internet-facing server, and a convincing email that persuades someone to open something.
Real example: the Colonial Pipeline attackers in 2021 didn’t need anything sophisticated. They used a password for a disused VPN account that appeared in a batch of leaked credentials. That account had no multi-factor authentication on it.
Where it breaks: MFA everywhere, prompt patching of anything reachable from the internet, and shutting down accounts nobody uses.
Making sure they can get back in
The first thing an intruder does is make their access durable. They set up a second and third way back into the network, so losing one doesn’t lock them out. Increasingly they use ordinary administration tools that already exist on your systems, precisely because those tools don’t look suspicious.
Why it matters: this is why “we changed that password” is not a fix. If someone has been inside for two weeks, the door they came through is rarely the only one still open.
Where it breaks: endpoint monitoring that flags unusual use of legitimate admin tools, and alerting on new accounts or scheduled tasks appearing.
Reading your organisation
Now they explore. Where are the file servers? Which systems would hurt most if they stopped? Where are the backups, and are they connected to the network? They read finance documents to work out what you can afford, and they check whether you have cyber insurance — because that tells them your ceiling.
The uncomfortable statistic: attackers commonly spend days to weeks inside a network before triggering anything. During that window there is nothing to see unless you are looking.
Where it breaks: network segmentation, so that compromising one laptop doesn’t grant a tour of everything, and monitoring for unusual internal scanning.
Becoming the administrator
One ordinary user account isn’t enough to encrypt a company. The goal is domain administrator — the keys to everything. Attackers get there by harvesting credentials left in memory on shared machines, exploiting misconfigured permissions, or simply finding a password in a document called something like server-passwords.xlsx.
Real example: in the 2023 attack on MGM Resorts, attackers reportedly phoned the IT help desk, impersonated an employee, and talked their way into a credential reset. No exploit required — just a convincing phone call.
Where it breaks: least privilege, separate accounts for admin work, and strict identity verification for help-desk resets.
Copying everything out first
Before anything is locked, the valuable data leaves — customer records, contracts, HR files, source code. Often it is uploaded to ordinary cloud storage services, because that traffic blends in with normal business use.
Why this stage exists: it is the insurance policy against your backups. If you restore everything and refuse to pay, they still hold your data and can publish it. This is what turned ransomware from an IT problem into a legal and reputational one.
Where it breaks: monitoring for large outbound transfers, and controls on which cloud services can be reached from inside the network.
The part everybody pictures
Only now do files get encrypted, usually at night or over a holiday weekend when nobody is watching. Backups are deliberately destroyed or encrypted first. Then the ransom note appears, typically with a countdown and a link to a private chat with the attackers.
The timing is deliberate: attacks cluster around Friday nights, public holidays, and long weekends. Fewer staff, slower detection, more hours to finish the job.
Where it breaks: offline or immutable backups that cannot be reached from the network, and a tested recovery plan — the emphasis being firmly on tested.
Stages 1 to 5 are invisible to most organisations. Stage 6 is impossible to miss. Nearly all the opportunity to prevent a disaster sits in the part nobody sees.
By the time you can see ransomware, you are not preventing an attack any more. You are recovering from one that finished.
How it actually spreads
Two different questions get muddled here: how attackers get into an organisation, and how the infection moves within one. They have different answers.
Getting in: the three doors
Where attacks begin
industry incident reports, broadly consistent year to yearProportions vary between reports and years, but the ranking is stubbornly stable: credentials and unpatched internet-facing systems consistently beat phishing as the way in.
That last point surprises people, because security training focuses so heavily on suspicious emails. Phishing is a genuine and major route — but a remote access portal with no multi-factor authentication is a permanently open door that requires no one to make a mistake at all. It just needs one password to appear in any of the billions already circulating from previous breaches.
Moving inside: how one machine becomes five hundred
Stolen credentials
The most common by far. With an administrator password, attackers simply log in to other machines. Nothing is “hacked” — they use the same tools your IT team does.
Management tools
Software built to push updates to every computer at once is perfect for pushing ransomware to every computer at once. Attackers actively hunt for it.
Network shares
Mapped drives are a gift. Anything a compromised user can write to, ransomware can encrypt — including that “backup” folder on the shared server.
Worm-like exploits
Rare but devastating. A flaw needing no human interaction lets the infection jump machine to machine automatically, in minutes rather than days.
The backup trap. A backup drive that is permanently connected and writable is not a backup as far as ransomware is concerned — it is just more files to encrypt. Attackers look for backups deliberately and destroy them first, because a company that can restore is a company that won’t pay. Backups must be offline, immutable, or in a separate account the compromised network cannot reach.
Five real attacks, and what each one teaches
These are the incidents worth knowing, not because they were the most sophisticated, but because each exposed a different weakness.
Case files
tap a caseWannaCry — the patch nobody applied
WannaCry spread itself. It used a flaw in an old Windows file-sharing protocol that let it jump from machine to machine with no human involvement, infecting well over 200,000 computers across 150 countries in a couple of days. Britain’s NHS was hit hard: ambulances diverted, thousands of appointments and operations cancelled.
The detail that stings: Microsoft had released the patch two months earlier. Every organisation that applied updates promptly was immune. The outbreak was eventually slowed when a researcher registered a domain name found in the code that acted as an accidental kill switch.
Lesson: patching internet-facing and networked systems is not administrative housekeeping. It is the single highest-return security activity most organisations can do.
NotPetya — the one that wasn’t really ransomware
NotPetya arrived through a poisoned update to a Ukrainian tax accounting package that most companies doing business in Ukraine were required to use. It looked like ransomware and demanded payment — but the encryption was designed to be irreversible. Paying achieved nothing. It was destruction dressed as extortion.
Shipping giant Maersk lost virtually its entire global IT estate and rebuilt roughly 4,000 servers and 45,000 computers in about ten days. Total worldwide damages have been estimated at around $10 billion, making it the costliest cyberattack in history.
Lesson: software you trust and update automatically is a route into your network. And a “ransom” is not always a real offer — recovery capability matters more than negotiating ability.
Colonial Pipeline — one password, one country queuing for fuel
The largest fuel pipeline in the US, carrying nearly half the East Coast’s supply, shut down for around six days. Panic buying emptied filling stations across several states and a state of emergency was declared.
The entry point was a single VPN account that was no longer in use, protected by a password that had leaked in an earlier breach elsewhere, with no multi-factor authentication. The company paid roughly $4.4 million in Bitcoin; US authorities later recovered a substantial portion of it. Notably, the pipeline itself was shut down as a precaution — the billing systems were the ones affected.
Lesson: disused accounts are live doors, reused passwords eventually surface in a leak, and MFA on remote access would have ended this attack before it began.
Kaseya — attacking a thousand companies at once
Rather than break into companies one by one, attackers compromised a tool that IT service providers use to manage their clients’ computers remotely. The ransomware was then pushed out through that trusted channel to roughly 1,500 downstream businesses in a single stroke — including a Swedish supermarket chain that had to close around 800 stores because its tills stopped working.
The attack landed on the Friday of a long holiday weekend in the US, when response teams were thinnest. That timing was not a coincidence.
Lesson: your security includes your suppliers’ security. Any vendor with remote access into your systems is part of your attack surface.
Change Healthcare — the most expensive lesson in MFA
Change Healthcare processes a large share of American medical claims. When it was hit, pharmacies could not verify insurance, providers could not bill, and parts of the healthcare payment system stalled for weeks. Parent company UnitedHealth ultimately reported costs running into billions of dollars, and the breach affected the data of well over a hundred million people.
The way in was a remote access portal without multi-factor authentication. A $22 million ransom was paid for a promise to delete the stolen data — then the criminal group collapsed in an apparent exit scam, the stolen data moved to a second gang, and a fresh extortion demand followed.
Lesson: paying buys a promise from criminals, not a guarantee. And when one company sits at the centre of an industry, its security is everyone’s problem.
Why it keeps happening: the business behind it
Ransomware persists because it has become an industry with specialised roles, not a hobby for lone hackers.
| Role | What they do | Why it matters |
|---|---|---|
| Developers | Build and maintain the software, run the leak site and payment infrastructure | They rent it out and take a cut — they rarely attack anyone directly |
| Affiliates | Do the actual break-ins using the rented toolkit | You don’t need technical depth to run an attack any more |
| Access brokers | Break into networks and sell that access to whoever wants it | Your network can be sold as a product before anyone encrypts anything |
| Negotiators | Handle the victim chat, apply pressure, arrange payment | Professionalised, scripted, and experienced at reading desperation |
This division of labour explains a lot. It explains why attacks are so consistent in method — affiliates follow playbooks. It explains why groups reappear under new names after being disrupted — the people move, the brand changes. And it explains why paying keeps the machine running: every payment funds the next round of development.
Should victims pay?
This is a decision for the organisation with legal counsel and law enforcement, and the honest position is that there is no clean answer. What can be said factually:
- Paying buys a decryption key that often works imperfectly — restoration from decryptors is typically slow and incomplete.
- Paying for deletion of stolen data buys a promise. The Change Healthcare case shows what that promise can be worth.
- Organisations that pay are disproportionately targeted again, sometimes by the same affiliate.
- In some jurisdictions, payments to sanctioned groups carry legal exposure of their own.
- Recovery from clean backups is usually faster than decryption — when those backups exist and have been tested.
Which is why the real decision is made long before the ransom note: an organisation that can restore has options, and an organisation that cannot has only one.
Defending against it, in priority order
Tick these off as you read — they’re ordered by how much protection they buy per unit of effort, and the first three stop the majority of real-world attacks outright.
Defence checklist
tap to tickIf it happens anyway. Isolate affected machines from the network but don’t power them off — useful evidence lives in memory. Don’t delete anything. Contact law enforcement and your cyber insurer early, since both may have resources and requirements you need. Assume data was stolen and plan your notifications accordingly. And resist the urge to restore in a rush: rebuilding into a network the attacker still has access to is a well-trodden way to be encrypted twice.
Four myths worth deleting
“We’re too small to be a target.”
Most attacks aren’t targeted at all — they’re opportunistic, driven by automated scanning for exposed systems and weak credentials. Small organisations are attacked constantly, precisely because they’re less likely to have monitoring, and a smaller ransom is still profit for a group running dozens of attacks a month.
“Our antivirus will catch it.”
Antivirus catches known malicious files. It struggles with an attacker who logs in with valid credentials and uses your own administration tools — which is exactly what most modern intrusions look like. Detection has to cover behaviour, not just files.
“We have backups, so we’re fine.”
Backups solve half the problem, and only if they’re offline and tested. They do nothing about stolen data being published, and connected backups are routinely destroyed by the attacker before encryption begins.
“It happens instantly when someone clicks.”
Encryption is the final act, often days or weeks after the initial break-in. That gap is the defender’s real opportunity — every attack that gets detected during it is an attack you never hear about.
Check yourself
Five questions. Open each to check — the correct option is marked.
1. At what point in a ransomware attack does encryption happen?
- Immediately when someone clicks a link
- Last, often days or weeks after the initial break-in
- Before the attacker gets administrator access
- Only after the ransom is refused
Encryption is stage six of six. Everything before it is invisible to most organisations, and it’s where the attack can still be stopped.
2. What was the entry point in the Colonial Pipeline attack?
- A zero-day exploit in industrial control systems
- A malicious email attachment opened by an executive
- A disused VPN account with a leaked password and no MFA
- A compromised software update
No sophistication required. One old account, one reused password, no second factor — and half the US East Coast’s fuel supply stopped moving.
3. Why do attackers steal data before encrypting it?
- Encryption doesn’t work without a copy
- So that good backups don’t remove the victim’s reason to pay
- To test whether the files are valuable
- It makes the encryption faster
Double extortion is the answer to backups. Restore everything and refuse to pay, and they publish your customers’ data instead.
4. Which single control would have prevented the most cases in this article?
- Antivirus software
- Employee phishing training
- Multi-factor authentication on internet-facing access
- A stronger firewall
Colonial Pipeline and Change Healthcare both came down to remote access without MFA. It’s unglamorous and it’s the highest-value control most organisations can deploy.
5. Why is a permanently connected backup drive a problem?
- It wears out faster
- Ransomware encrypts anything writable, and attackers destroy backups first
- It slows the network down
- It isn’t a problem
Attackers hunt for backups deliberately, because a company that can restore is a company that won’t pay. Offline or immutable is the requirement.
Frequently asked questions
How does ransomware get onto a computer?
Most commonly through stolen or guessed credentials on remote access systems without multi-factor authentication, through unpatched internet-facing software, or through a convincing email attachment or link. Less often, through a compromised software update from a trusted supplier.
How long does a ransomware attack take?
The encryption itself takes hours. The intrusion leading up to it commonly takes days to weeks, during which attackers explore the network, escalate their access, and copy data out. The visible part is the very end of a long, quiet process.
Can encrypted files be recovered without paying?
Sometimes. Free decryptors exist for older or flawed ransomware families, and projects like No More Ransom collect them. For current strains with correctly implemented encryption, breaking it is not realistic — recovery means restoring from backups.
Does paying the ransom actually work?
Partially, often. Decryption keys usually work but restoration is typically slow and imperfect, and promises to delete stolen data are unverifiable — the Change Healthcare case ended with a second gang demanding a second ransom for the same data. Paying also marks an organisation as willing to pay.
What should a small business do first?
Turn on multi-factor authentication everywhere, especially email and any remote access. Then get backups that are disconnected from the network and actually test restoring from them. Those two steps cost very little and remove the majority of realistic attack paths.
The takeaway
Ransomware is not really a story about encryption. It’s a story about access — how someone gets in, how far they can move once inside, and how long they can stay before anyone notices. The encryption at the end is just the invoice.
Which is why the defences that matter are so unglamorous. Not clever software, but multi-factor authentication on the front door, patches applied on time, backups the attacker can’t reach, and a plan that has been rehearsed before it’s needed. Colonial Pipeline, Change Healthcare, WannaCry — every one of them turns on something a checklist would have caught.
If you take one action after reading this, make it the smallest one: check whether multi-factor authentication is switched on for your email and any remote access you use. That single setting appears in the story of more prevented attacks than anything else in this article.
ransomwarecybersecuritymalwarephishingdata breachMFA
