Ransomware dominates security headlines, which creates the impression that it is inevitable and unstoppable. In reality, most ransomware attacks follow a predictable sequence, and most can be stopped if you catch them early enough. The organisations that pay the largest ransoms are usually the ones that catch the attack too late.
This article walks through how attacks unfold and where you can interrupt the sequence.
The phases of a ransomware attack
Phase 1: Initial compromise. The attacker gets access to a machine. This happens through phishing, an unpatched vulnerability, a default password, or weak credentials. Most of the time it is phishing, which means someone clicked something they should not have.
At this point the attacker has access to one machine, usually not a valuable one. The potential damage is enormous but it has not yet happened.
Phase 2: Persistence and privilege escalation. The attacker installs malware that persists across reboots and finds a way to gain administrative access to the system. This often happens immediately but might take hours or days.
Phase 3: Network reconnaissance. The attacker, now with a foothold, maps the internal network. Where are the valuable systems? Where is the backup? Who else is on the network? Where can they move laterally?
This phase might take days or weeks. Many attackers at this stage are not yet sure what they are attacking.
Phase 4: Lateral movement. The attacker uses the compromised credentials and systems to move deeper into the network, compromising more machines and collecting more credentials.
Phase 5: Backup destruction. The attacker locates your backups and deletes them, or locks them, or exfiltrates them. This is the point at which the attack changes from recoverable to devastating.
Phase 6: Encryption. The attacker encrypts files across the network, making them inaccessible. The ransom note appears.
This sequence is not universal — some attacks combine phases or skip some — but it is typical. The critical observation is that phases 1-5 give you time to detect and stop the attack before catastrophe.
Where to stop each phase
Stopping phase 1: This is where most security efforts should focus. Phishing training and detection reduce successful phishing campaigns. Patching known vulnerabilities eliminates many entry points. Enforcing strong unique passwords with multi-factor authentication makes credential compromise less useful.
You will never stop all phishing, but you can stop 95% of common phishing campaigns. The 5% that get through are the ones you need to catch in phase 2.
Stopping phase 2: If an attacker has compromised a machine and installed malware, endpoint detection and response (EDR) software should catch it. EDR monitors behavior on machines and alerts when something looks wrong: unusual network connections, sudden file modifications, privilege escalation attempts.
Good EDR catches most malware, especially if you have people actually reviewing the alerts. Abandoned EDR — software installed but never monitored — is worse than useless; it gives you a false sense of security.
Stopping phase 3: Network monitoring shows unexpected traffic, unusual outbound connections, or scanning behaviour. A system trying to enumerate the network usually leaves signs if you are looking for them. This is where a network monitoring tool or SIEM helps.
Stopping phase 4: Lateral movement often requires stolen credentials, which means authentication logs show unusual login patterns. Authentication logging is often neglected because logs are verbose and hard to parse, but unusual patterns (logins from unexpected places, logins at unusual times, password spray attacks) are detectable if you monitor them.
Stopping phase 5: Backup integrity checks show if backups are being modified. If backups are stored on immutable media or read-only snapshots that cannot be deleted by a compromised machine, this phase is stopped entirely.
Phase 6: Once encryption is happening, recovery is much harder. You are either relying on backups or paying the ransom. This is why every other phase matters.
The common failure patterns
No active monitoring. The organisation has EDR installed but nobody is actually looking at the alerts. Anomalies happen every day but nobody reviews them. The attacker sits in the environment for weeks undetected.
Alert fatigue. The monitoring system produces hundreds of alerts per day, most of them false positives or harmless. The human team ignores alerts out of exhaustion. Real attacks hide in the noise.
Backup vulnerabilities. Backups are stored on a shared drive where a compromised machine has delete permissions. Backups are not tested, so nobody knows if they actually work. Backups are not properly isolated from the main network.
Lack of segmentation. Once an attacker is on the network, they can reach everything. A workstation compromise becomes a domain compromise because there is no separation between networks or between systems.
Slow incident response. An alert happens, but nobody investigates for hours or days. By the time anyone looks, the attacker has long since moved deeper.
No password hygiene. Default passwords exist. Credentials are shared. Passwords are reused. When one system is compromised, many others are immediately vulnerable.
A practical defence strategy
For an organisation of 10-100 people:
Invest in phishing detection. This catches most attacks before they start. Modern email security is cheap relative to the damage prevention. Expect to spend £100-500 per month.
Deploy endpoint detection and response. Install EDR on all machines and actually staff it. Someone should be reviewing alerts daily. If you cannot afford to staff it, you cannot afford the risk. Expect to spend £200-1,000 per month.
Implement multi-factor authentication everywhere. Especially email and administrative access. This stops many lateral movement attacks because stolen credentials are useless without the second factor.
Test your backups. Restore them regularly. Know that they work. Store them offline or in read-only snapshots so a compromised machine cannot delete them.
Segment your network. At minimum, separate workstations from servers, and servers from backups. Better to have a dedicated segment for backups that is only accessed for restoration.
Monitor authentication logs. Look for failed logins, logins from unusual places, or login storms. These are often early signs of an attack.
Have an incident response plan. Before an attack happens, you should know how to isolate a machine, preserve logs, notify people, and bring systems back online. A plan you have is vastly better than improvising while under attack.
Spend on detection, not just prevention. Prevention is necessary but insufficient. Some attacks will get through. The difference between a small incident and a catastrophic one is how fast you detect and respond to attacks that do get through.
The cost comparison
A small organisation with basic hygiene, good email security, EDR, and monitoring might spend £3,000-5,000 per month on security. A ransomware attack that destroys unrecoverable data might cost £100,000-1,000,000 including recovery, downtime, and negotiation.
The organisations paying the largest ransoms — millions of pounds — are typically the ones that skipped the early-phase detection and let attacks progress to encryption. They are paying for their failure to detect, not for advanced attacker sophistication.
The honest assessment
Ransomware is a business model that works because many organisations are not defended against the early phases. They assume they can prevent every attack (impossible), and they do not detect the ones that get through (negligent).
You will not prevent every attack. What you can do is detect it early enough to stop it before the ransomware runs. That is not hypothetical or aspirational. It happens regularly at organisations that prioritise early detection.
Organisations that get hit hardest are the ones that gambled on prevention alone and lost.