Ransomware incidents are often described as "one morning none of the files would open", but encryption is usually the last step of the attack. By then the attackers have typically come in through a VPN, remote desktop or a phishing email, gained administrative rights, mapped the network, deleted the backups and copied data out. The time between the break-in and the encryption is the defender's window to spot something unusual and contain the damage to one machine or one account.

This article breaks a typical ransomware attack into seven stages: what the attacker is doing at each one, what traces it leaves, and where a company can put up a barrier. It is written for IT staff responsible for networks, servers and endpoints, and for managers deciding where security budget should go first.

Ransomware is now a division-of-labour business

Most high-impact ransomware incidents today are not the work of a single hacker but of the Ransomware-as-a-Service (RaaS) model. Operators build the encryption payloads, payment portals and leak sites; affiliates carry out the intrusion, escalate privileges and deploy the ransomware, and the two split the proceeds. Access brokers sit alongside them, breaking into companies and selling that foothold to other criminals[2]. Microsoft calls this "human-operated ransomware": people make decisions at every stage based on what they find in the victim's environment, rather than a piece of malware spreading on its own[2].

For defenders this means two things. First, the same ransomware brand can sit behind affiliates with very different techniques, so chasing one family's signatures is not enough. Second, whichever encryptor is deployed at the end, the earlier steps of intrusion, privilege escalation and lateral movement look very similar. Defences spread across the whole chain pay off far better than a bet on any single product.

The typical attack chain: seven stages

1. Initial access

The most common ways in fall into three groups: remote access services exposed to the internet (VPNs, remote desktop, Citrix and similar gateways), usually entered with valid credentials[3]; unpatched vulnerabilities in internet-facing devices and systems; and phishing emails carrying malicious attachments or links[1]. The credentials may come from earlier data leaks, password spraying, or simply a purchase from an access broker[2]. For hardening and patching internet-facing equipment, see edge device hardening and patch prioritization.

2. Privilege escalation and persistence

Once inside, attackers steal credentials stored on systems, work towards domain admin rights, and create new accounts or install legitimate remote management tools such as AnyDesk or TeamViewer as a backup way in[2]. Because these tools are ordinary software, antivirus will not necessarily block them, so "who installed a remote tool on which host" is itself a signal worth monitoring.

3. Reconnaissance and lateral movement

Attackers enumerate privileged accounts, Group Policy settings and security products in Active Directory, then move between hosts with PsExec, WMI or remote desktop, sometimes using penetration-testing frameworks such as Cobalt Strike[2]. Attackers need time to learn the environment, which makes this the stage with the best chance of catching them and the best return on detection investment.

4. Disabling defences and recovery

Before encrypting, attackers try to disable or tamper with antivirus and EDR[2], and delete Windows shadow copies, backup catalogs, virtual machine snapshots, and even network-connected backups and cloud snapshots so the victim cannot recover on its own[4]. CISA notes that many ransomware variants actively look for accessible backups and then delete or encrypt them[1].

5. Data theft

To strengthen their negotiating position, attackers package and send out sensitive data first. Common tools include Rclone, Rsync and various web-based file storage services[1].

6. Encryption

Mass encryption comes last. The targets are not only user documents and databases but can also be entire disk partitions or whole virtual machines on hypervisors such as ESXi[5]. When one virtualization host is encrypted, dozens of servers running on it can go down together.

7. Extortion and pressure

"Double extortion" means threatening to publish stolen data on top of encrypting it; CISA has also seen groups skip encryption altogether and use the threat of publication as their only lever[1]. If the victim still refuses to pay, some groups go further, harassing employees, customers and even executives' families, or knocking the company's website offline, which is why the terms "triple extortion" and "multi-extortion" are also used[6]. The incident response guide from Taiwan's Administration for Cyber Security likewise lists "claims to have stolen sensitive data in advance and threatens to publish or sell it by a deadline" as one of the signs of a ransomware attack[7].

Warning signs you can see before encryption

Ransomware usually leaves the following traces before it encrypts anything. Any one of them is worth investigating the same day, not next week:

  • New administrator accounts with no matching change request, or existing accounts suddenly added to privileged groups[2]
  • Remote management tools that the company does not use appearing on servers, or changed remote desktop settings[2]
  • Someone querying the list of domain admins, Group Policy or security product configuration[2]
  • Antivirus or EDR disabled or removed, or tamper-protection alerts[2]
  • Unusual remote execution through PsExec or WMI, or one account logging on to many hosts in a short time[2]
  • An abnormal rise in outbound data, especially uploads to cloud storage services[1]
  • Shadow copies or backups being deleted, which usually means encryption is imminent[2]

VPN logins from unfamiliar countries outside business hours, or a burst of failed logins on one account, are also common signs at the initial access stage. Each of these can have an innocent explanation on its own, so you need to know what "normal" looks like in advance: which accounts are supposed to use remote management tools, and which servers routinely send large amounts of data out.

Key defences at each stage

Close the entry points

Limit privilege escalation and lateral movement

  • Keep domain admin accounts off ordinary workstations and member servers; give every machine a different local administrator password (for example with LAPS); remove local admin rights from regular users[2]
  • Workstations rarely need SMB or remote desktop connections to one another; restrict them with host firewalls and network segmentation
  • Block remote management tools the company does not use[2]

Protect security tools and backups

Detect data theft

  • Monitor for abnormal outbound volumes and for tools such as Rclone[1]
  • Allow server network segments to reach only the external destinations they need, and block everything else

First moves when it happens

The Administration for Cyber Security's incident response guide says that once a ransomware attack is confirmed, you should, without shutting machines down, immediately unplug the network cables of affected devices and turn off Wi-Fi and mobile data, isolating affected network segments if needed; force a password reset for domain admin and other privileged accounts while keeping one emergency account that can log on at the physical console; and scan backups for lurking malware before restoring anything[7]. The guide specifically warns against forcing a shutdown or reboot, because encryption keys and related information may still be held briefly in memory and would be lost[7]. For the full sequence of response steps, see the first 24 hours.

Resources for companies in Taiwan

  • The Administration for Cyber Security's incident response guide, published in July 2026, covers six common scenarios including ransomware, with how to recognize each, what to do and what not to do, plus a checklist and a public statement template[7]
  • TWCERT/CC's ransomware protection site organizes resources and reporting channels into before, during and after an attack[8]
  • When an incident happens, you can report it online to TWCERT/CC, and report crimes to the police[7]; listed companies should also check their material information disclosure obligations, and organizations covered by the Cyber Security Management Act must report under that law
  • This site's ransomware category and incident list collect recent real-world cases you can compare against these techniques

Action checklist

  1. List every internet-facing VPN, remote desktop, remote management portal and firewall management interface. Confirm each has MFA and is fully up to date; switch off anything that does not need to be reachable from outside.
  2. Check whether domain admin accounts have ever logged on to ordinary workstations. Set up tiered admin accounts and deploy local administrator password management such as LAPS.
  3. Confirm tamper protection is on for antivirus and EDR, and make sure alerts such as "protection disabled", "privileged account created" and "shadow copies deleted" reach a person immediately, including outside office hours.
  4. Inventory the remote management tools the company actually uses and block all others.
  5. Make sure at least one backup copy is offline or immutable, and that the backup system's accounts are separate from the domain. Schedule a real restore drill this quarter.
  6. Set alert thresholds for large outbound uploads from server network segments.
  7. Take the ransomware scenario from the Administration for Cyber Security guide and run a tabletop exercise with management, legal and communications: who decides to cut the network, who files the reports, and which backup channel you use if company email is down.
  8. Subscribe to our alerts to track vulnerabilities and attack campaigns affecting the equipment you run.