Ransomware encrypts an organisation’s data and demands payment for the key. Most modern groups also steal data first and threaten to leak it (“double extortion”).
Typical attack chain
- Initial access — phishing, stolen VPN/RDP credentials, or an unpatched internet-facing service.
- Privilege escalation and discovery — attackers map the network and harvest admin credentials.
- Lateral movement — remote admin tools spread access to servers and backups.
- Exfiltration — sensitive data is copied out for extortion.
- Impact — backups are deleted and files are encrypted, often at night or over a weekend.
Early indicators
- New admin accounts or unusual use of remote-management tools.
- Volume shadow copies or backup jobs being deleted.
- Large outbound transfers to unfamiliar cloud storage.
- Mass file renames or spikes in file-write activity.
Defence and recovery
- Keep offline or immutable backups and test restores regularly.
- Patch internet-facing systems first — prioritise vulnerabilities in the CISA KEV catalog.
- Require MFA for remote access and admin accounts; remove local admin rights.
- Segment networks so one compromised host cannot reach everything.
- Deploy EDR and centralise logs in a SIEM such as Wazuh.
- Have and rehearse an incident response plan, including who to call.