Ransomware Readiness: How Modern Attacks Unfold and How to Be Ready

Ransomware readiness means three things: making the usual ways in hard to use, making sure you can restore without the attacker's help, and knowing exactly what you will do in the first hour. Modern ransomware is less a virus than a business process. A criminal logs in with a stolen password or an unpatched VPN, spends hours or days taking control, copies your data, then encrypts what it can and threatens to publish the rest.

The threat is not shrinking. The FBI's Internet Crime Complaint Center received more than 3,600 ransomware complaints in 2025, with reported losses above $32 million, and the FBI notes that figure is artificially low because it excludes downtime and recovery costs. Verizon's 2026 Data Breach Investigations Report found ransomware in 48% of all breaches it analysed.

The controls that stop most attacks are known, cheap relative to an outage, and mostly configuration work.

How modern ransomware actually works

Forget the image of a lone hacker writing malware. Most ransomware today runs on a franchise model called ransomware-as-a-service (RaaS). CISA describes LockBit, one of the most prolific groups, as an operation where the core group maintains the ransomware and sells access to "affiliates" who carry out the intrusions in exchange for a fee or a share of the profits.

That split matters. Affiliates vary widely in skill and method, so there is no single "ransomware signature" to block. You defend against behaviours: stolen logins, movement between machines, disabled security tools, and data leaving.

From encryption to extortion

Ransomware started as "pay us to decrypt your files". It has become a menu of pressure tactics:

• Double extortion. Steal the data first, then encrypt. If you restore from backup, the attacker threatens to publish what it took. CISA's Akira advisory describes exactly this model.
• Multi-extortion. Add more pressure on top: contacting your customers, harassing staff, or flooding your website with traffic.
• Data theft only. Some groups skip encryption entirely. In the 2023 MOVEit campaign, CISA reports the Cl0p group exploited a zero-day flaw in a file transfer product and used a web shell to steal data from MOVEit databases. CISA notes that since 2021 the group had "preferred to rely mostly on data exfiltration over encryption". Scam Atlas tracks this pattern as data theft extortion.

Backups and hypervisors are now targets

Attackers know backups are your way out, so they go after them. CISA's #StopRansomware Guide warns that many variants try to find and delete or encrypt any backups they can reach.

Encrypting one hypervisor (the host that runs many virtual machines) takes down dozens of servers at once. CISA reports Akira affiliates encrypting VMware ESXi virtual machines and, in a June 2025 incident, Nutanix AHV disk files. The Scattered Spider advisory records the same ESXi targeting.

Extortion tactics and what blunts each

Backups answer only half the table. Restoring servers does nothing about data already stolen, so prevention and data minimisation matter as much as recovery.

Action checklist

• List the systems whose loss would stop your business for more than a day.
• Find out where your most sensitive data lives (customer records, payroll, contracts) and who can reach it.
• Confirm whether you run a hypervisor (VMware, Hyper-V, Nutanix) and who holds its admin credentials.
• Check whether your backup system logs in with the same accounts as everything else.
• Delete or archive sensitive data you no longer need, so there is less to steal.

How attackers get in

Ransomware starts with access, and the same few entry points recur. CISA's guide organises its prevention advice around six initial access vectors: internet-facing vulnerabilities and misconfigurations, compromised credentials, phishing, precursor malware infections, advanced social engineering, and third parties or managed service providers.

Stolen credentials and unprotected remote access

The single most common story is a VPN or remote desktop login with no second factor. CISA reports Akira affiliates got in through VPN services "without multifactor authentication (MFA) configured", alongside exposed remote desktop and valid stolen credentials. Microsoft's 2025 Digital Defense Report found that more than 97% of identity attacks are password attacks, and that MFA can block over 99% of identity-based attacks.

Infostealer malware, reused passwords from old breaches, and phished logins all end up for sale. The credential hygiene guide covers the personal side of this.

Exploited edge devices

Firewalls, VPN gateways and file transfer servers sit on the internet by design, so a flaw in one is an open door. Verizon's 2026 DBIR found that 31% of breaches now start with software vulnerabilities, overtaking stolen passwords as the top way in. The CISA Akira advisory lists specific Cisco and SonicWall VPN flaws used for entry.

Phishing and help desk social engineering

Email phishing still works, but the more dangerous variant now runs over the phone. CISA's Scattered Spider advisory describes actors who posed as IT or help desk staff, sent repeated MFA prompts until someone pressed "Accept", and talked mobile carriers into moving a victim's phone number. Each has a Scam Atlas entry: help desk reset impersonation, MFA fatigue, and the email bombing plus fake IT support combination.

Third parties and suppliers

Your managed service provider, remote monitoring tool and file transfer vendor all reach into your network. The MOVEit campaign hit organisations through a product they trusted.

Common mistakes

• Turning on MFA for email but leaving the VPN or remote desktop on password only.
• Treating a firewall as "set and forget" while its firmware falls years behind.
• Using SMS codes as the second factor for admins, which SIM swapping defeats. See why SMS MFA is not real MFA.
• Giving your IT provider permanent admin access with a shared account.

Action checklist

• List every way into your network from the internet: VPN, remote desktop, remote support tools, webmail, file transfer.
• Confirm each one requires MFA, and prefer phishing-resistant methods for admins.
• Close any remote desktop port exposed directly to the internet.
• Ask your IT provider how they access your systems and whether their accounts use MFA.
• Write down the help desk rule for password and MFA resets, including how callers are verified.

What AI changes, and what it does not

AI is making existing attacks faster and more convincing. It has not yet produced ransomware that skips the steps above. Keep those two statements separate.

What is observed

Google's Threat Intelligence Group reported in November 2025 that state and criminal actors use Gemini to write phishing material and run reconnaissance on targets. For most misuse, it still describes productivity gains rather than new capabilities. Microsoft's 2025 report says threat actors are using AI to automate phishing.

The UK's National Cyber Security Centre assesses that AI will "almost certainly" make elements of intrusion operations more effective and efficient through 2027. It notes that the time between a flaw's disclosure and its exploitation has already shrunk to days, and expects AI to shorten it further.

What is still early

Google found malware that calls an AI model while it runs, including a proof-of-concept ransomware called PROMPTLOCK. Google rates that family as experimental, and says another, PROMPTFLUX, "does not demonstrate an ability to compromise a victim network or device". Treat claims of fully autonomous AI ransomware as speculative until a primary source shows it in real incidents.

What this means for you

Phishing no longer has spelling mistakes, voices can be cloned, and your patch window is shorter. The defences stay the same. Phishing-resistant MFA does not care how well the lure was written. A tested offline backup does not care how the attacker got in. The AI-powered social engineering guide covers the human side in detail.

Action checklist

• Remove "look for bad grammar" from your awareness training and replace it with "verify the request through a known channel".
• Shorten your patch target for internet-facing systems to days, not weeks.
• Add one voice-based scenario (fake IT support or fake executive) to your next training session.
• Ignore any product pitch that promises to "stop AI ransomware" without naming which step of the attack it blocks.

A realistic attack timeline

Timelines range from hours to months, but the stages are consistent. Knowing them shows where you can stop the attack before encryption.

1. Initial access. A stolen login, an exploited VPN flaw, or a malicious file. An "initial access broker" often sells this foothold.
2. Establishing control. The attacker adds accounts and remote access tools, often legitimate admin software that blends in.
3. Discovery and privilege escalation. It maps the network, finds domain admin accounts, and looks for the backup server and hypervisors.
4. Defence evasion. It tries to disable antivirus or EDR, delete logs, and remove shadow copies.
5. Exfiltration. It copies data out. CISA notes that in some Akira incidents, data left the network in just over two hours from initial access.
6. Encryption. Often launched at night or on a weekend, against servers, file shares and hypervisors at once.
7. Extortion. A ransom note points to a negotiation site, usually with a leak-site countdown.

By the time you see a ransom note, the data has usually left. Your best detection chances are stages 2 to 4: new admin accounts, disabled security tools, and unfamiliar remote access software.

Action checklist

• Turn on alerts for new admin accounts and changes to admin group membership.
• Alert when antivirus or EDR is disabled or uninstalled on any machine.
• Keep an approved list of remote access tools and flag anything else.
• Make sure someone actually reads those alerts on weekends, or that a provider does.

Prevention that matters most

The FBI's 2025 report lists a short set of priorities, and they match CISA's: offline and immutable backups, MFA, least privilege, EDR, segmentation, and patching, with known exploited flaws in internet-facing systems first. Do these well before buying anything else.

The priority order

How to do each one

MFA. CISA calls for phishing-resistant MFA on all services, especially email, VPNs and accounts that access critical systems. Hardware security keys or passkeys for admins are the strongest option. For background, see minimising credential theft with MFA.

Patching. Watch CISA's Known Exploited Vulnerabilities catalogue. An exploited firewall or VPN flaw is an emergency.

Least privilege. Nobody should read email from a domain admin account. Use separate admin accounts only for admin work. A privileged access management tool helps at larger sizes.

EDR. Endpoint detection and response records behaviour on each machine and can isolate it remotely. The FBI notes EDR tools are particularly useful for spotting lateral movement. Unmonitored EDR is just a recording of your breach, so add a managed service if you lack security staff. Compare options on the EDR and XDR platforms page.

Segmentation. Put backups, hypervisor management and finance systems on separate network segments that ordinary laptops cannot reach. The zero trust architecture explainer covers the longer-term model.

Email security. Set up SPF, DKIM and DMARC so attackers cannot spoof your domain, using the email authentication stack guide.

Common mistakes

• Buying an expensive tool before MFA and patching are done.
• Exempting executives or "legacy" service accounts from MFA.
• Leaving the backup server joined to the same domain as everything else.

Action checklist

• Enable MFA on every remote access path, email account and admin account this week.
• Patch or replace any internet-facing device with a known exploited flaw.
• Create separate admin accounts and stop using admin accounts for daily work.
• Deploy EDR to every laptop and server, and decide who watches the alerts.
• Move backups and hypervisor management onto a network segment ordinary users cannot reach.
• Publish DMARC for your domain, starting at p=none and moving to enforcement.

Backups that survive the attack

A backup the attacker can delete is not a backup. You need a copy that is out of reach and proven to restore.

The 3-2-1 rule, updated

CISA's small business guidance describes the 3-2-1 rule: three copies of important files, on two different types of storage, with one copy kept off-site. For ransomware, add one requirement: at least one copy must be offline or immutable (unable to be changed or deleted, even by an admin, for a set period). The FBI's 2025 report asks for backups that are encrypted, immutable, and cover the entire organisation's data.

CISA adds one caution worth repeating: immutable cloud storage helps, but misconfiguration can be costly. Check the retention lock is actually on.

Protect the backup credentials

Attackers delete backups by logging in to the backup console with stolen admin credentials. So:

• Use separate credentials for the backup system that are not in your main directory.
• Require MFA on the backup console and the cloud storage account.
• Restrict who can shorten retention or delete restore points, and alert when anyone tries.

Test the restore, not the backup job

CISA advises scheduled recovery tests, confirming you can restore both fully and partially, and that you can roll back at least seven days. Time a full restore of your most important system. That number is your real recovery time.

In Sophos's vendor research, the State of Ransomware 2026 survey of 2,158 IT leaders found attackers succeeded in encrypting data in 56% of attacks, with a median ransom payment of $769,000. A restore you have rehearsed is what lets you ignore that demand. For product options, see the ransomware backup and recovery comparison.

Common mistakes

• Backing up only servers and forgetting cloud apps like email and file sharing.
• Keeping the only "offline" copy on a drive that stays plugged in.
• Storing the recovery runbook on the server that just got encrypted.

Action checklist

• Confirm you have three copies, two media types, and one copy off-site.
• Make at least one copy offline or immutable, and verify the retention lock is enabled.
• Move backup admin credentials out of your main directory and put MFA on them.
• Run a timed restore of your most critical system this quarter.
• Print the recovery runbook and keep a copy off the network.

The first hour and the first day

The instinct is to wipe and rebuild immediately. Resist it: you destroy the evidence of how they got in, and likely rebuild with the same hole open.

The first hour

1. Isolate, do not wipe. CISA's checklist says to identify affected systems and isolate them immediately, taking the network offline at the switch level if many systems are hit. Pull network cables or disable Wi-Fi.
2. Do not power off unless you must. CISA advises powering down only if you cannot disconnect a device from the network, because shutting down erases evidence held in memory.
3. Use out-of-band communication. Assume the attacker can read your email and chat. Switch to phone calls or a separate messaging account, as CISA recommends.
4. Call your incident lead and your insurer. Many cyber policies require you to use their approved response firm and to notify them quickly.
5. Start a written log of times and actions, on an unaffected device.

The first day

• Bring in incident response help. In the UK, the NCSC says organisations should use an NCSC-assured Cyber Incident Response provider.
• Report to law enforcement. In the US, report to CISA, your local FBI field office or the FBI's IC3. In the UK, report at gov.uk/report-cyber. Elsewhere, use your national cyber agency or police cyber unit.
• Check for a free decryptor. Law enforcement may hold keys: the FBI says it has given out thousands of decryption keys since 2022. No More Ransom, backed by Europol and the Dutch police, hosts free tools for some families.
• Triage by business priority, using your predefined critical system list.
• Assess what was stolen. This drives breach notification duties, which have legal deadlines in many jurisdictions. Get legal advice early.
• Reset credentials from a clean machine. Especially admin, backup and service accounts.

The ransom question

Whether to pay is a business and legal decision. Know the considerations before the day comes:

• No guarantee. The NCSC says payment does not guarantee access to your devices or data, and that "you cannot trust a promise to delete" stolen data. Victims have found data sold or re-used for extortion later.
• Sanctions risk. The US Treasury's Office of Foreign Assets Control warns that paying a sanctioned party can be a violation on a strict liability basis, and that the US government "strongly discourages" paying. OFAC treats prompt, complete reporting to law enforcement as a significant mitigating factor.
• No regulatory credit. NCSC guidance notes the UK ICO does not treat a ransom payment as reducing any penalty.
• Root cause. Paying without fixing the entry point invites a repeat.

Take legal advice and involve law enforcement before any decision. This guide does not cover negotiation.

Action checklist

• Write a one-page first-hour plan: who isolates, who calls whom, which phone numbers to use.
• Record your insurer's incident hotline and policy number somewhere off the network.
• Save the reporting contacts for your country (IC3 and CISA in the US, gov.uk/report-cyber in the UK).
• Choose an incident response firm in advance, and check whether your insurer requires one.
• Agree who has authority to make the ransom decision, and that legal counsel is involved.
• Run a one-hour tabletop exercise with this plan once a year.

What every employee should do

Employees often see an attack first. The first hour depends on them reporting fast rather than fixing it alone.

Signs that something is wrong

• Files renamed with strange extensions, or a ransom note on screen or as a text file.
• Many MFA prompts you did not trigger.
• A flood of junk email followed by a call or Teams message from "IT support" offering to help.
• A call asking you to install a remote access tool or read out a code.

What to do

1. Disconnect. Unplug the network cable or turn off Wi-Fi. Leave the machine powered on.
2. Report immediately using the phone number your IT team gave you, not a number from the ransom note or the caller.
3. Do not pay, reply, or click anything in the ransom note.
4. Do not try to clean it yourself or restart repeatedly.
5. Write down what you saw and when.

Never approve an MFA prompt you did not start or install software for a caller. The workplace security habits guide builds these into daily routine, and secure remote and mobile work covers home setups. Small business owners can use the solo founder security stack as a starting baseline.

Action checklist

• Put the IT and security emergency number on a sticker or card every employee keeps.
• Tell staff in writing that reporting a false alarm is always fine.
• Teach everyone the "disconnect, do not power off" rule.
• Tell staff that real IT will never ask for an MFA code or ask them to approve a prompt.

Your complete checklist

• List your critical systems and where your sensitive data lives.
• Delete sensitive data you no longer need.
• Inventory every internet-facing way into your network.
• Enable MFA on remote access, email, admin and backup accounts, phishing-resistant for admins.
• Close remote desktop exposed directly to the internet.
• Patch internet-facing devices within days of a known exploited flaw.
• Separate admin accounts from daily accounts.
• Deploy EDR everywhere and assign someone to watch alerts, including weekends.
• Alert on new admin accounts and disabled security tools.
• Segment backups, hypervisor management and finance systems.
• Publish DMARC and move it to enforcement.
• Keep 3-2-1 backups with one offline or immutable copy.
• Protect backup credentials outside your main directory, with MFA.
• Run a timed restore of your most critical system.
• Write and print a first-hour response plan with off-network contacts.
• Pick an incident response firm and confirm your insurer's requirements.
• Save law enforcement reporting contacts for your country.
• Agree who decides on a ransom and involve legal counsel.
• Train every employee to disconnect, report and never approve unexpected MFA prompts.
• Run a ransomware tabletop exercise once a year.