Walkthrough
Anatomy of a Ransomware Attack
Updated
Modern ransomware is rarely one click. It is usually a person inside the network for days or weeks: they get a doorway, map the firm, take admin accounts, copy files, kill backups, and only then lock the shares. This page walks six defender-visible stages so a non-expert can see where MFA, logging, and a restore that sits off the office path still change the ending. It is a walkthrough, not a how-to. For the SonicWall SSL VPN chain, see Akira ransomware and the SonicWall SSL VPN attack chain.
Initial access — the doorway. A phishing mail, a remote login without MFA, or an unpatched edge device.
Internet
Anyone can knock
Stolen copies
Not yet
The doorway
Firewall · VPN · mail
File server
Client files
Staff PC
Workstation
Admin / domain
Directory
Backups
Office NAS
Stage 01
Initial access — the doorway
A phishing mail, a remote login without MFA, or an unpatched edge device.
Stage 01
Initial access — the doorway
They get a foothold through a mail message someone was supposed to open, a VPN or remote desktop login that did not need a second factor, or an internet-facing firewall left unpatched. Nothing looks like a movie lock screen yet. MFA on every remote login, patched edge devices, and mail that is actually filtered are the locks on that door.
Stage 02
Reconnaissance and persistence
Once inside, they install remote access that looks like ordinary IT support and slowly learn the floor plan: file servers, domain controllers, backup jobs. This quiet mapping is why the chain often takes days or weeks. Unexpected remote-access software and logins at odd hours are the tell — if someone is watching.
Stage 03
Privilege escalation and expansion
They hunt for high-level admin passwords and use them to move from one machine to the next. One domain admin account is a master key for the whole firm. Least privilege, unique admin accounts, and an alert on unusual admin logins shrink that key.
Stage 04
Data exfiltration — the first trap
Before they encrypt, they copy client files, drawings, or tax work to their own storage so they can threaten a leak even if you restore. A backup does not undo a copy that already left. Unusual outbound transfers — and a desk that notices them — matter here.
Stage 05
Backups neutralized, security tools turned off
They wipe the restore points sitting on the same machines, corrupt backups that share the office path, and turn off the software meant to catch them. Copies that only live next to production are in the blast radius. Immutable or off-network backups, plus detection that alerts when someone tries to kill the agent, are the counter.
Stage 06
Mass encryption and the demand
Then they lock files across servers together and leave a note. That last move is fast. Isolation, a restore you have already tested off this path, and a partner who answers are what keep the practice open. Paying is a legal and business decision — not an IT shortcut.
Questions firms ask
Straight answers before the share locks.
- How fast can ransomware lock a professional firm?
- The quiet work — mapping, admin theft, copying files — often takes days or weeks. The lock at the end can be hours. Speed depends on how flat the network is and whether anyone is watching VPN logins, remote tools, and outbound copies. A live desk still changes the ending; a ticket that replies tomorrow does not.
- If we have backups, are we safe?
- Backups help only if they restore after this chain. They need to sit where the office admin account cannot rewrite them, be tested on a calendar, and still matter after a copy of the files has already left. A backup that has never been restored is a hope, not a plan — and carriers ask for the proof.
- What should we do if someone opened a suspicious file?
- Take the workstation off the network, do not pay or reboot into a cleanup you have not planned, and call a partner who will contain first. The same rule applies to a strange VPN success or a remote-support tool nobody asked for. Manage IT NY at (631) 557-0440 is a desk that answers — not a form that promises a ticket number.
Ready to stay open — and ready for the carrier.
Book a call about backups that restore, MFA and logging a carrier will accept, and a desk that answers when a file should not have been opened. This is insurance readiness and operations — not a scare reel.