How Ransomware Attacks Work

Modern Ransomware Is Not Random

The popular image of ransomware as malware that randomly infects a computer and demands Bitcoin is outdated. Modern ransomware attacks against businesses are deliberate, multi-stage operations carried out by organized criminal groups. Attackers conduct reconnaissance, establish persistent access, move laterally through the network over days or weeks, and only deploy the ransomware payload after reaching the most valuable systems. The average dwell time — the period between initial compromise and ransomware deployment — was over three weeks in 2024.

Stage 1: Initial Access

Attackers enter the network through one of several well-documented vectors:

• Phishing — A malicious email tricks an employee into clicking a link or opening an attachment that deploys malware or steals credentials
• Exploited vulnerabilities — Unpatched systems with known vulnerabilities in VPNs, firewalls, RDP, or web-facing services are directly exploited
• Stolen credentials — Credentials obtained from prior breaches, dark web purchases, or credential-stuffing attacks are used to authenticate directly
• Supply chain — A trusted vendor or software component is compromised, providing access to all customers

Stage 2: Persistence and Reconnaissance

After initial access, attackers establish persistence mechanisms to maintain access even if the initial entry point is discovered and closed. They then conduct internal reconnaissance: mapping the network, identifying domain controllers, locating backup systems, and finding the most valuable data. This phase can last days, weeks, or longer.

Stage 3: Lateral Movement and Privilege Escalation

Using a combination of stolen credentials, privilege escalation exploits, and legitimate Windows tools (a technique called "living off the land"), attackers move from their initial foothold to higher-value systems. The goal is typically to reach domain administrator privileges, which gives them control over the entire Active Directory environment.

Stage 4: Data Exfiltration

Before deploying ransomware, most modern groups copy sensitive data to their own infrastructure. This enables double extortion: demanding payment both to decrypt files and to prevent public release of the stolen data. Even organizations with good backups now face this threat.

Stage 5: Ransomware Deployment

With access to domain administrator credentials, attackers deploy ransomware simultaneously across the entire environment — encrypting servers, workstations, and backup systems. The business discovers it when employees cannot access files and ransom notes appear on screens.

Where Penetration Testing Helps

Every stage of the attack chain above has a corresponding defensive measure that penetration testing validates. External testing finds the exploited vulnerabilities before attackers do. Internal testing identifies privilege escalation paths and lateral movement opportunities. Phishing assessments reveal which employees will click. A comprehensive penetration test maps the exact attack chain an adversary would follow — before they do.