# Ransomware: how an attack unfolds

> How a ransomware attack progresses from first access to extortion, why paying rarely ends it, and what to do in the first 24 hours.

Source: https://www.malware.com.au/ransomware/
Last updated: 2026-08-24

---

The encryption is the *end* of a ransomware attack, not the beginning. By the
time a ransom note appears, an operator has usually been inside for days or
weeks. Understanding that sequence is what makes the difference between
catching one at stage two and discovering it at stage six.

## How an attack progresses

**1. Initial access.** Most commonly one of: valid credentials bought from an
initial access broker, an unpatched internet-facing appliance, or a phishing
lure. Often no malware at all at this stage, just a legitimate login from an
illegitimate person.

**2. Establishing a foothold.** A loader or remote access tool goes in,
usually with persistence that survives reboots. Sometimes nothing is installed
and the attacker simply keeps using your VPN.

**3. Credential theft and escalation.** Harvesting cached credentials,
attacking the domain controller, hunting for service accounts with excessive
rights. The objective is domain administrator or its cloud equivalent.

**4. Reconnaissance.** Quiet and deliberate. What data is valuable, what would
be embarrassing, who approves payments, what cyber insurance you hold, and, critically, **where the backups are and whether they can be reached**.

**5. Exfiltration.** Data leaves, usually to cloud storage that looks like
ordinary business traffic. This is the step that creates a notifiable data
breach, and it happens *before* anything visible occurs.

**6. Deployment.** Backups are deleted or encrypted first, security tooling is
disabled, then encryption runs everywhere at once, deliberately timed for a
Friday evening, a public holiday, or the start of the Christmas shutdown.

**7. Extortion.** The note. Then a countdown, a sample of stolen data on a
leak site, and often direct contact with your customers, staff or regulator to
increase pressure.

## Why "we have backups" is no longer a complete answer

Double extortion changed the arithmetic. Encrypting and stealing are separate
harms with separate remedies, and backups only address one:

| Harm | Restores fix it? | Paying fixes it? |
| --- | --- | --- |
| Systems unavailable | **Yes** | Sometimes, slowly |
| Data stolen and published | No | **No**: deletion is unverifiable |
| Credentials compromised | No | No |
| Attacker still has access | No | No |

An attacker's promise to delete stolen data is worth nothing. There is no
mechanism by which you could verify it, and the same crews reappear against
the same victims.

## The first 24 hours

**Hours 0–1: contain without destroying evidence**

1. Disconnect affected systems from the network. **Do not power them off** if
   you can avoid it, because memory contents are often the best evidence, and do not
   rebuild or reimage anything yet.
2. Disable remote access: VPN, RDP, and any third-party or vendor access.
3. Preserve logs immediately. Firewall, VPN, email, endpoint, authentication.
   Many retention windows are 30 days or shorter.
4. Assume email is compromised. Move incident coordination to a channel the
   attacker is not sitting in: phone, or a separate messaging service.
5. Note **when you became aware, and of what**. Reporting timeframes generally
   run from an awareness point you may later have to evidence, so write it down
   while it is fresh.

**Hours 1–4: get help and meet your obligations**

6. Call the Australian Cyber Security Hotline: **1300 CYBER1** (1300 292 371),
   free, 24/7.
7. Notify your cyber insurer **before** engaging an incident response firm.
   Most policies require prior approval and will decline unapproved costs.
8. Engage legal counsel early. Privilege over the investigation is easier to
   establish at the start than to argue for later.
9. Work out which reporting regimes apply. See
   [reporting it to ASD](https://www.cyber.gov.au/report). Several separate reporting duties can
   apply to one incident, so check each with its own regulator.

**Hours 4–24: establish scope**

10. Determine what data was accessed or taken. This is the question every
    subsequent obligation turns on, and it is answered by logs, not by
    assumption.
11. Force a password reset and revoke active sessions across the estate.
    Session cookies survive password changes unless you explicitly revoke them.
12. Begin the [NDB assessment](https://www.oaic.gov.au/privacy/notifiable-data-breaches) if personal
    information may be involved. The clock started at suspicion, not
    confirmation.
13. Prepare holding statements for staff, customers and media before you need
    them.

## If a payment is made

Australia has reporting rules for ransomware and extortion payments, introduced
by the *Cyber Security Act 2024*. Whether they apply to you depends on turnover
and on whether you run a critical infrastructure asset, and there are timeframes
attached. A payment made on your behalf, by an insurer or a negotiator, is still
a payment for these purposes.

**The current thresholds and the deadline are on ASD's page, not repeated
here.** They are the kind of detail that changes, and a figure copied onto a
third-party page is exactly the sort of thing that goes quietly stale. If a
payment is genuinely on the table you should have a lawyer anyway, and they will
work from the Act rather than from either page.

Report it to ASD: https://www.cyber.gov.au/report

Sanctions law is the sharper risk. Paying an entity subject to Australian
sanctions can be a serious offence entirely separate from the reporting
obligation, and attribution is often uncertain. This is a decision for
lawyers, not for 2am.

## What actually prevents this

Working backwards from the attack chain, the controls that break it earliest:

- **Phishing-resistant MFA** on email, VPN and every administrative account, which breaks stage 1. [Which MFA counts](/multi-factor-authentication/).
- **Patch internet-facing systems within days**: breaks stage 1.
- **Remove standing domain admin rights**; make privilege temporary and
  approved, which breaks stage 3.
- **Offline or immutable backups**, restore-tested, unreachable from a
  compromised admin account, which breaks stage 6.
- **Egress monitoring**: large uploads to unfamiliar cloud storage is the
  clearest late-stage signal you will get, and it catches stage 5.
- **Network segmentation** so one compromised workstation does not reach
  everything.

These are largely [the Essential Eight](/essential-eight/), which is the point
of it.

## Common questions

### How long does a ransomware attack take?

The encryption is the last step and takes hours. The intrusion behind it typically runs for days to weeks, spent stealing credentials, mapping the network and locating backups. By the time you see a ransom note, the attacker has usually been present far longer than the incident feels.

### Should we pay the ransom?

Paying does not reliably end the incident: decryptors are often slow or incomplete, stolen data is not reliably deleted, and payment marks you as willing to pay. There are also reporting rules for larger entities, and sanctions law can apply depending on who receives the funds. Both are situation-specific, so check ASD’s current guidance and take legal advice before deciding.

### Will backups protect us from ransomware?

Backups solve availability, not disclosure. Most current campaigns steal data before encrypting, so restoring cleanly can still leave you with a disclosure to assess. Backups also only work if they are offline or otherwise unreachable from a compromised administrator account, because attackers look for the backups first.


## Primary sources

- [ASD: Ransomware](https://www.cyber.gov.au/threats/types-threats/ransomware)
- [ASD: Australian Cyber Security Centre annual cyber threat report](https://www.cyber.gov.au/about-us/view-all-content/reports-and-statistics)
- [Cyber Security Act 2024 (Cth)](https://www.legislation.gov.au/C2024A00115/latest/text)

---

General information only, not legal advice. Whether an obligation applies
turns on facts about your organisation and the incident. Check the primary
sources above and obtain legal advice.

Emergency: Australian Cyber Security Hotline 1300 CYBER1 (1300 292 371), 24/7.