How ransomware works: the full attack lifecycle, step by step

A ransomware attack works in stages: an intruder gets into the network, usually with a stolen login or an unpatched edge device, spends days or weeks escalating privileges and mapping the environment, copies out the most damaging data, destroys the backups, and only then encrypts everything and leaves a ransom note. By the time the screen lights up, the crime is mostly over. Understanding that sequence, and the choke points in it, is what separates a contained incident from a front-page one.

This guide walks the full lifecycle in ten stages, with the tools operators actually use at each one and the control that breaks it. It draws on the Ransomnews confirmed dataset of more than 9,500 verified attacks, and on what intrusions look like from inside incident response. For the plain-English definition, start with What is ransomware?

Stage 1: initial access

Almost every ransomware intrusion begins with one of three footholds.

• Compromised credentials. Stolen, phished or brute-forced logins for VPNs, remote desktops, single sign-on portals and cloud admin consoles. Initial-access brokers buy and sell these in bulk, and infostealer logs supply a growing share: a stolen session cookie replays a login that has already passed multi-factor authentication.
• Edge-device exploitation. Unpatched VPN concentrators, firewalls, file-transfer appliances and email gateways. Cl0p built its 2023 campaign on a single zero-day in MOVEit Transfer, and firewall vulnerabilities have opened the door to a large share of 2025 and 2026 intrusions. Exposed remote desktop remains the cheapest way in.
• Phishing and malware loaders. Malicious attachments and links that drop a loader, which in turn fetches the hands-on-keyboard toolkit. Less dominant than five years ago, still common against smaller organisations.

For defenders this is the highest-leverage stage. Phishing-resistant multi-factor authentication on every external service, prompt patching of anything internet-facing, and modern email security stop most intrusions before they start.

Stage 2: establishing a foothold

Once inside, the operator sets up command and control. Cobalt Strike beacons remain the workhorse despite years of detection investment, alongside Sliver, Brute Ratel and increasingly bespoke implants. They also install legitimate remote-management tools, AnyDesk, Atera, Splashtop, ScreenConnect, because these look like something the IT department would run, and most environments do not block them by default. A second remote-access path is nearly always planted so that discovery of the first does not end the intrusion.

Stage 3: reconnaissance

Now the attacker maps the environment. They enumerate Active Directory with AdFind, BloodHound and SharpHound; identify domain controllers, file servers, backup servers and hypervisors; pull lists of privileged users; and read internal documentation that names the crown-jewel systems. They are looking for two things: the data that will hurt most when stolen, and the infrastructure that will hurt most when encrypted. They also read the cyber-insurance policy if they can find it, because it tells them what the victim can afford.

Stage 4: privilege escalation

To do real damage the operator needs domain-administrator rights or their equivalent. They get there by dumping credentials from memory (Mimikatz, LSASS dumps), Kerberoasting service accounts, abusing misconfigured Active Directory Certificate Services, extracting NTDS.dit, or simply finding a privileged password in a script on a file share. Modern endpoint protection makes credential theft noisier than it used to be, which is why EDR with credential-theft protection is one of the two or three controls that change outcomes, but a patient operator still gets there in most environments.

Stage 5: lateral movement

With elevated rights the attacker spreads, and the toolkit is overwhelmingly built from legitimate Windows administration: PsExec, WMI, WinRM, PowerShell remoting, scheduled tasks and Group Policy. This is what “living off the land” means, and it is why ransomware operators are so hard to spot on a network already noisy with real admin activity. Network segmentation and a tiered administration model, where domain-admin credentials never touch ordinary workstations, are the controls that make this stage slow and loud.

Stage 6: data exfiltration

This is the stage the public still underestimates. Before any encryption, the operator stages the data they want, financial records, customer and patient data, source code, executive email, contracts, and copies it to storage they control. Rclone to cloud providers such as Mega and cloud object storage is the standard tool; FTP and direct uploads to bulletproof hosts are common. Volumes run from gigabytes to many terabytes and exfiltration can take days. Egress monitoring is one of the most underused detection opportunities a defender has, and this is the stage that turns a recoverable encryption event into a data breach with notification duties, regulatory exposure and a leak-site listing.

Stage 7: backup destruction

Before the payload runs, the backups die. Volume Shadow Copies are deleted with vssadmin or wmic. Backup catalogues are wiped. Veeam, Commvault and similar servers are targeted directly: operators harvest credentials from their consoles, log in, and delete or encrypt the repositories. Cloud snapshots get the same treatment if cloud-admin keys are available. The point is to remove every option except paying, which is why an immutable, offline and tested backup is the single control that most reliably decides whether a victim pays.

Stage 8: encryption

Now the payload is deployed at scale, typically through Group Policy, PsExec, or straight onto the ESXi hypervisors, where encrypting the virtual disk files takes out hundreds of servers in minutes. Modern lockers use a hybrid scheme: a per-file symmetric key (AES or ChaCha20) encrypts each file, and that key is wrapped with a public key (RSA or Curve25519) whose private half lives only on attacker infrastructure. Most families encrypt large files only partially, headers or interleaved chunks, enough to make the file useless and fast enough to finish before anyone reacts. The detonation is timed for a Friday night, a holiday eve or the small hours, when response is slowest.

Stage 9: the ransom note

Notes are dropped in every directory and often set as the desktop wallpaper. They direct the victim to a Tor negotiation portal with a unique ID, a chat interface and a countdown. The portal is staffed, and modern operators run it like a sales channel: discounts for fast payment, proof-of-data packs, and test decryption of a few files to show the decryptor works. How negotiations actually run is covered separately; the short version is that the opening demand is a starting position, not a price.

Stage 10: extortion and what comes after

If the victim refuses, the operator escalates. Stolen data is teased on the group’s leak site, then published in instalments. Some groups call customers and journalists, email employees, or launch DDoS attacks on the victim’s public services. A few file complaints with regulators or stock-market disclosure regimes to manufacture legal pressure. Increasingly the data is simply sold, which is why the operators of 2026 are as much data brokers as extortionists.

If the victim pays, they receive a decryptor, usually slow, often buggy, occasionally broken, and a promise that the stolen data has been deleted, which cannot be verified. Most confirmed victims now refuse: among those whose decision is on the public record, fewer than one in ten paid in 2025, down from nearly three in ten in 2018, a trend set out in the ransomware payment rate analysis.

How long a ransomware attack takes

The gap between initial access and encryption is measured in days to weeks, and it has been shrinking. Well-resourced affiliates with a clean foothold can move from first login to detonation inside a few days; a cautious operator working a large, segmented estate can take a month. The encryption itself takes minutes to hours. Recovery, by contrast, takes weeks: rebuilding domain controllers, restoring from backups, forensics, and the notification and regulatory work that follows data theft. The ransom note is the middle of the story, not the beginning.

Where the kill chain breaks

The good news for defenders is that this is a long chain and every link is an opportunity. Phishing-resistant MFA breaks stage 1. EDR with credential-theft protection breaks stage 4. Segmentation and tiered administration break stage 5. Egress monitoring catches stage 6. Immutable, offline, tested backups make stage 7 fail. And a rehearsed incident-response plan, like the one in our IR runbook, turns a stage 9 ransom note from a corporate crisis into a hard but manageable week. Nobody has to win every stage. Winning any one of the early ones is usually enough.

Frequently asked questions

Sources and further reading

• What is ransomware?, the plain-English companion to this guide, and double extortion explained.
• Ransomware IR runbook and what the first hour of a breach should look like.
• Ransomware statistics and confirmed attacks by sector, country and year: the dataset behind the figures here.
• MITRE, ATT&CK: the reference framework for the techniques described at each stage.
• CISA, StopRansomware: joint advisories on individual ransomware operations, with indicators and mitigations.