Ransomware is often the last stage, not the first
The encryption is the end of the story, not the beginning.
By the time files lock, an attacker has usually been inside for days or weeks: getting in, looking around, taking administrator rights, finding the backups, copying out the data worth threatening you with. The locking happens last, when they have everything they need and want to be noticed. This changes where detection is worth investing. The ransom note is the one moment you cannot miss and also the one moment when it is too late to do anything about it.
More on Ransomware and malware
- Backups are ransomware targetsThe lifeboat goes first
- Lateral movement turns one foothold into manyAlong the loft, house to house
- Command and control gives malware an operatorSomebody is still holding the controller
- Persistence is about surviving changeStill there after the tide
- Living off the land reduces new-tool visibilityThey use your tools, not theirs
- Ransomware recovery is an identity problem tooThe data is the easy half