How a ransomware attack unfolds

  1. Initial access. Common entry points are exposed remote access services, unpatched internet-facing systems, stolen credentials and phishing. Access is often bought from an initial access broker.
  2. Expansion. Attackers escalate privileges, move across the network and disable backups and security tools.
  3. Data theft. Sensitive files are copied out to use as leverage.
  4. Encryption and extortion. Systems are encrypted, a ransom note is left, and the victim may be named on the group's leak site.

Ransomware as a service

Many groups run ransomware as a service: developers build the malware and leak site, and affiliates carry out attacks in return for a share of the ransom. This lowers the skill needed and is one reason attacks are so widespread. Groups rebrand and splinter frequently, so tracking their tactics matters more than tracking their names.

Reducing ransomware risk

  • Reduce the external attack surface: patch internet-facing systems quickly, especially vulnerabilities on the CISA KEV list.
  • Remove or protect exposed remote access such as RDP and old VPN appliances.
  • Enforce multi-factor authentication and monitor for leaked credentials.
  • Keep offline, tested backups that attackers cannot reach.
  • Watch ransomware leak sites for your organisation and your suppliers.

How DarkInvader helps

DarkInvader shrinks the routes ransomware groups use to get in, by finding exposed services and exploitable vulnerabilities on your external attack surface and alerting on leaked credentials. Dark Web Monitoring also watches leak sites for your organisation and suppliers.

Explore Dark Web Monitoring

Frequently asked questions

Should we pay a ransomware demand?

UK law enforcement and the NCSC advise against paying. Payment does not guarantee recovery or deletion of stolen data, and it funds further attacks. Organisations should take legal advice and report the incident.

What is double extortion?

Double extortion is when attackers both encrypt systems and steal data, then threaten to publish the data if the ransom is not paid. Some groups now skip encryption and rely on data theft alone.

How do ransomware groups usually get in?

Most often through exposed and unpatched internet-facing systems, stolen or reused credentials, exposed remote access services and phishing. Managing the external attack surface removes many of these routes.

Related terms and reading

Sources