Ransomware groups collected over $1.1 billion in payments in 2023. By 2026, the model has evolved: most attacks now combine data encryption with exfiltration and public leak threats — double extortion means paying the ransom does not guarantee your data stays private. Understanding how these attacks work at a technical level is the first step toward building defenses that actually stop them.
How Modern Ransomware Gets In
Initial access comes from a narrow set of techniques. Phishing emails with malicious attachments or links remain the most common vector — accounting for roughly 41% of ransomware incidents in 2025 according to Coveware data. Exposed RDP ports (3389) with weak passwords are the second most common entry point. Vulnerability exploitation on internet-facing systems — VPNs, Exchange servers, and firewall management interfaces — accounts for most of the rest.
- Phishing: Malicious Office macros, LNK files, or HTML smuggling delivering initial droppers (Qakbot, IcedID, Emotet)
- RDP brute force: Credential stuffing or password spraying against exposed port 3389
- VPN exploitation: Unpatched Ivanti, Fortinet, Cisco, or Palo Alto vulnerabilities giving direct network access
- Compromised credentials: Credentials purchased from initial access brokers on dark web markets
Key insight: Most ransomware operators do not exploit the target themselves. They buy access from Initial Access Brokers — specialists who compromise networks and sell access by industry and revenue. Your defenses need to stop the IAB, not just the ransomware payload.
The Attack Timeline: What Happens Between Access and Encryption
Dwell time — the gap between initial access and ransomware deployment — averages 5 days in 2026. During that window, attackers execute a predictable playbook:
- Reconnaissance: Enumerate the domain, identify domain controllers, locate backup servers and security tools
- Privilege escalation: Move from initial low-privilege access to domain admin via credential theft, Kerberoasting, or exploiting local misconfigurations
- Lateral movement: Use tools like BloodHound, Mimikatz, and legitimate admin tools (PsExec, WMI, RDP) to spread across the network
- Data exfiltration: Steal data before encrypting — typically using rclone to upload to Mega, cloud storage, or attacker-controlled servers
- Defense impairment: Disable AV, delete Volume Shadow Copies (
vssadmin delete shadows /all), stop backup services - Deployment: Push ransomware binary via GPO, PsExec, or WMIC to all domain-joined machines simultaneously
Critical detection window: The most reliable detection opportunity is during lateral movement. Mimikatz execution, PsExec across non-standard paths, and vssadmin commands from unexpected processes are all high-fidelity indicators. If your SIEM has rules for these, you can catch attacks before encryption starts.
How the Encryption Works
Modern ransomware uses hybrid encryption: AES-256 (symmetric, fast) encrypts individual files, and RSA-2048 or Curve25519 (asymmetric) encrypts the AES key. The private key that decrypts your AES key is held by the attacker — on their infrastructure, not yours. Without it, decryption is computationally infeasible. Some groups generate keys locally, some generate them server-side; this distinction matters when evaluating whether decryptors exist for a given variant.
Check NoMoreRansom.org before considering any payment. Law enforcement agencies have decryption keys for several active ransomware families and provide them for free.
Detection: What to Alert On
Configure your SIEM and EDR with rules for these high-confidence ransomware indicators:
- Mass file extension changes in a short time window (file rename events ≥ 100/minute)
vssadmin delete shadowsorwmic shadowcopy deletefrom any process- LSASS memory access by non-system processes (credential theft)
- Encoded PowerShell execution (
-encor-EncodedCommandflags) - PsExec or WMIC usage from workstations (lateral movement)
- Rclone or unusual cloud sync tools running outside business hours
- Backup agent services stopping unexpectedly
Resilience: The 3-2-1-1-0 Backup Rule
The 3-2-1 backup rule (3 copies, 2 media types, 1 offsite) is the foundation. In 2026, extend it to 3-2-1-1-0: add 1 air-gapped or immutable backup copy (S3 Object Lock, Veeam immutable backups, or a physically disconnected tape), and verify 0 errors on every restore test. Most organizations have backups. Most have never successfully restored from them under time pressure. Test your restore process quarterly — with a timer.
Quick win: Enable S3 Object Lock with Governance Mode on your cloud backup bucket today. Ransomware cannot delete or modify object-locked backups even with compromised admin credentials. This is the single highest-ROI ransomware defense available for cloud-hosted backups.
Incident Response: First 60 Minutes
- Isolate affected systems from the network immediately — pull the cable or disable the port, do not power off (preserve forensic evidence in RAM)
- Identify patient zero: the first encrypted system, the earliest alert, the initial phishing email
- Check NoMoreRansom.org for a free decryptor before doing anything else
- Engage your IR retainer or an external forensics firm if you do not have internal capability
- Report to law enforcement: FBI IC3, CISA, and relevant sector regulators
- Begin parallel restore from known-clean backup once eradication is confirmed
On paying the ransom: Only 65% of organizations that paid a ransom in 2025 fully recovered their data. Payment also funds the next attack and potentially violates OFAC sanctions if the group is on the Treasury list. Exhaust all alternatives before paying — including checking for free decryptors and contacting law enforcement for decryption assistance.
n
🔗 Further Reading
Frequently Asked Questions
n
How does ransomware encryption work?
n
Modern ransomware uses hybrid encryption: AES-256 (symmetric) encrypts individual files quickly, while RSA-2048 or Curve25519 (asymmetric) encrypts the AES decryption key. The private RSA key is held on attacker-controlled infrastructure. Without it, decryption is computationally infeasible. This architecture means paying the ransom provides the private key needed to decrypt the AES keys, which then decrypt the files.
n
n
What is double extortion ransomware?
n
Double extortion ransomware combines traditional file encryption with data theft. Attackers exfiltrate sensitive data before deploying ransomware, then threaten to publish it on a dedicated leak site if the ransom is not paid. This means even organizations with perfect backups face pressure to pay. Triple extortion adds DDoS attacks or direct contact with the victim's customers as additional leverage.
n
n
Should I pay a ransomware ransom?
n
Payment is generally not recommended. Only 65% of organizations that paid ransoms in 2025 fully recovered their data. Payment funds future attacks. Some ransomware groups are on OFAC sanctions lists, making payment potentially illegal. Before considering payment: check NoMoreRansom.org for free decryptors, contact FBI IC3 and CISA for assistance, and exhaust backup restoration options. Engage legal counsel before any payment decision.
n
n
What is the average ransomware dwell time?
n
Ransomware dwell time — the gap between initial access and encryption deployment — averaged 5 days in 2026, down from 24 days in 2022. During this window, attackers enumerate the domain, escalate privileges, perform lateral movement, exfiltrate data, and disable backups. This compressed timeline means detection during the lateral movement phase is critical — once encryption begins, containment requires immediate network isolation.
n
n
n
