Ransomware: how an attack unfolds

The encryption is the end of a ransomware attack, not the beginning. By the time a ransom note appears, an operator has usually been inside for days or weeks. Understanding that sequence is what makes the difference between catching one at stage two and discovering it at stage six.

How an attack progresses

1. Initial access. Most commonly one of: valid credentials bought from an initial access broker, an unpatched internet-facing appliance, or a phishing lure. Often no malware at all at this stage, just a legitimate login from an illegitimate person.

2. Establishing a foothold. A loader or remote access tool goes in, usually with persistence that survives reboots. Sometimes nothing is installed and the attacker simply keeps using your VPN.

3. Credential theft and escalation. Harvesting cached credentials, attacking the domain controller, hunting for service accounts with excessive rights. The objective is domain administrator or its cloud equivalent.

4. Reconnaissance. Quiet and deliberate. What data is valuable, what would be embarrassing, who approves payments, what cyber insurance you hold, and, critically, where the backups are and whether they can be reached.

5. Exfiltration. Data leaves, usually to cloud storage that looks like ordinary business traffic. This is the step that creates a notifiable data breach, and it happens before anything visible occurs.

6. Deployment. Backups are deleted or encrypted first, security tooling is disabled, then encryption runs everywhere at once, deliberately timed for a Friday evening, a public holiday, or the start of the Christmas shutdown.

7. Extortion. The note. Then a countdown, a sample of stolen data on a leak site, and often direct contact with your customers, staff or regulator to increase pressure.

Why “we have backups” is no longer a complete answer

Double extortion changed the arithmetic. Encrypting and stealing are separate harms with separate remedies, and backups only address one:

Harm	Restores fix it?	Paying fixes it?
Systems unavailable	Yes	Sometimes, slowly
Data stolen and published	No	No: deletion is unverifiable
Credentials compromised	No	No
Attacker still has access	No	No

An attacker’s promise to delete stolen data is worth nothing. There is no mechanism by which you could verify it, and the same crews reappear against the same victims.

The first 24 hours

Hours 0–1: contain without destroying evidence

1. Disconnect affected systems from the network. Do not power them off if you can avoid it, because memory contents are often the best evidence, and do not rebuild or reimage anything yet.
2. Disable remote access: VPN, RDP, and any third-party or vendor access.
3. Preserve logs immediately. Firewall, VPN, email, endpoint, authentication. Many retention windows are 30 days or shorter.
4. Assume email is compromised. Move incident coordination to a channel the attacker is not sitting in: phone, or a separate messaging service.
5. Note when you became aware, and of what. Reporting timeframes generally run from an awareness point you may later have to evidence, so write it down while it is fresh.

Hours 1–4: get help and meet your obligations

6. Call the Australian Cyber Security Hotline: 1300 CYBER1 (1300 292 371), free, 24/7.
7. Notify your cyber insurer before engaging an incident response firm. Most policies require prior approval and will decline unapproved costs.
8. Engage legal counsel early. Privilege over the investigation is easier to establish at the start than to argue for later.
9. Work out which reporting regimes apply. See reporting it to ASD. Several separate reporting duties can apply to one incident, so check each with its own regulator.

Hours 4–24: establish scope

10. Determine what data was accessed or taken. This is the question every subsequent obligation turns on, and it is answered by logs, not by assumption.
11. Force a password reset and revoke active sessions across the estate. Session cookies survive password changes unless you explicitly revoke them.
12. Begin the NDB assessment if personal information may be involved. The clock started at suspicion, not confirmation.
13. Prepare holding statements for staff, customers and media before you need them.

If a payment is made

Australia has reporting rules for ransomware and extortion payments, introduced by the Cyber Security Act 2024. Whether they apply to you depends on turnover and on whether you run a critical infrastructure asset, and there are timeframes attached. A payment made on your behalf, by an insurer or a negotiator, is still a payment for these purposes.

The current thresholds and the deadline are on ASD’s page, not repeated here. They are the kind of detail that changes, and a figure copied onto a third-party page is exactly the sort of thing that goes quietly stale. If a payment is genuinely on the table you should have a lawyer anyway, and they will work from the Act rather than from either page.

Report it to ASD: https://www.cyber.gov.au/report

Sanctions law is the sharper risk. Paying an entity subject to Australian sanctions can be a serious offence entirely separate from the reporting obligation, and attribution is often uncertain. This is a decision for lawyers, not for 2am.

What actually prevents this

Working backwards from the attack chain, the controls that break it earliest:

• Phishing-resistant MFA on email, VPN and every administrative account, which breaks stage 1. Which MFA counts.
• Patch internet-facing systems within days: breaks stage 1.
• Remove standing domain admin rights; make privilege temporary and approved, which breaks stage 3.
• Offline or immutable backups, restore-tested, unreachable from a compromised admin account, which breaks stage 6.
• Egress monitoring: large uploads to unfamiliar cloud storage is the clearest late-stage signal you will get, and it catches stage 5.
• Network segmentation so one compromised workstation does not reach everything.

These are largely the Essential Eight, which is the point of it.