Encryption is the part of a ransomware attack that everyone notices, but it is also the last thing that happens. By the time file extensions start changing and ransom notes appear on every desktop, the attacker has usually already spent hours or days walking through the network unseen, collecting passwords, mapping servers, and quietly disabling the very tools meant to stop them. Understanding that sequence, not just the encryption itself, is what separates organizations that catch an intrusion early from those that discover it only after the damage is done.
How Attackers Get Their First Foothold Inside a Windows Network
Every ransomware case starts with a single point of entry, and in a Windows environment that entry point is rarely exotic. Stolen or brute forced credentials against exposed remote services remain one of the most common openings, closely followed by phishing emails that trick a user into opening an infected attachment or handing over a login. Unpatched internet facing systems make up the third major route: a forgotten remote access appliance, an outdated web server, or a vulnerable edge device that nobody flagged for patching. The 2021 Colonial Pipeline incident remains one of the clearest illustrations of how small this opening can be. A single compromised remote access account without multi factor authentication gave the DarkSide group access to the network, and the intruders reportedly sat inside for about a week before deploying anything destructive. The ransom eventually paid out reached 4.4 million dollars in bitcoin, but the more expensive damage was the shutdown of a pipeline supplying nearly half the fuel used along the East Coast of the United States.
More recent intrusion data shows the initial access picture has broadened rather than narrowed. Incident responders increasingly report attackers combining stolen session tokens, compromised edge devices, exposed remote management ports, and trusted third party access alongside classic phishing. In one documented recent case, attackers reached a company through an internet facing IIS web server compromised via a web shell planted on top of a vulnerable ASP.NET application, then spent the following hours quietly expanding their access before anyone noticed anything unusual on the network.
Quiet Reconnaissance That Maps the Domain Before Anyone Notices
Once inside, an attacker rarely acts immediately. The priority shifts to reconnaissance: identifying what kind of machine has been compromised, what account privileges are available, whether the host belongs to a domain, and which systems nearby hold anything valuable. This stage is intentionally slow and quiet, because speed at this point risks tripping an alert before the intruder has secured a durable position. Attackers commonly rely on native Windows utilities for this work rather than custom malware, a pattern security teams call living off the land. Commands built into the operating system, such as network and account enumeration tools, blend into normal administrative traffic and rarely raise suspicion on their own.
During reconnaissance, attackers also look for defensive tooling running on the host. Endpoint detection agents, antivirus products, and logging services are catalogued so they can be disabled or bypassed later in the intrusion. Modern ransomware affiliates treat this phase as seriously as the technical exploitation itself, because a single overlooked detection tool can end the operation before the payoff stage.
Stealing Credentials From LSASS Memory and the SAM Database
Credential theft is the pivot point of nearly every serious ransomware intrusion, because a workstation compromise on its own is worth very little compared to domain administrator rights. On Windows systems, login credentials are cached in memory inside a process called the Local Security Authority Subsystem Service, commonly abbreviated LSASS. This process stores authentication material in several formats, including hashed passwords and Kerberos tickets, so that a signed in user does not need to re enter a password every time they access a shared resource. Attackers target this process directly, dumping its memory contents to extract reusable credentials that let them authenticate as legitimate users elsewhere on the network.
A parallel technique targets the Security Account Manager database, which stores local account password hashes on disk. Because this file is normally locked while Windows is running, attackers frequently use the operating system's own Volume Shadow Copy mechanism to create a snapshot of the disk, then copy the SAM and SYSTEM registry files out of that snapshot where the lock does not apply. Security researchers have documented multiple ransomware operators dumping LSASS memory immediately before deploying an encryptor, describing credential theft as a defining feature of what analysts now call human operated ransomware, as distinct from older, fully automated worm style malware. Once an attacker holds domain administrator credentials, effectively every server and workstation on that domain becomes reachable.
How a Single Workstation Moves Sideways Into a Full Domain Compromise
With valid credentials in hand, the intrusion shifts into lateral movement, the stage where a single infected laptop becomes a foothold across dozens or hundreds of machines. Incident response data collected in recent years consistently points to a small set of favored techniques: authenticating to Windows administrative shares over the SMB protocol, issuing commands remotely through Windows Management Instrumentation, and connecting to other hosts through the Remote Desktop Protocol. These are not obscure hacking tools; they are standard administrative features built into every Windows deployment, which is precisely what makes them effective and hard to distinguish from legitimate IT activity.
The pace of this stage has accelerated sharply compared to just a few years ago. Where an intrusion once took several hours to progress from initial login to internal network scanning, recent case studies describe network scanning and lateral movement beginning within minutes of a successful login, particularly in campaigns targeting exposed edge and remote access devices. Detection research has settled on a useful rule of thumb here: a single beacon quietly checking in from one workstation can hide for days, but the same process suddenly authenticating to fifty different hosts over SMB within an hour is an unmistakable signal. Security teams increasingly build alerts around exactly that kind of volume spike, since it tends to surface the intrusion well before the payload ever executes.
Destroying the Way Back by Wiping Shadow Copies and Local Backups
Before triggering encryption, attackers methodically dismantle an organization's ability to recover without paying. Windows machines routinely keep local backup snapshots through the Volume Shadow Copy Service, which under normal circumstances lets an administrator restore a file to an earlier state after accidental deletion or corruption. Ransomware operators treat these snapshots as their single biggest obstacle, because a victim with intact shadow copies can often restore encrypted files without ever contacting the attacker.
Analysts tracking this stage of the attack lifecycle classify it as an inhibit system recovery technique, and describe several distinct methods attackers use to achieve it: quietly deleting all existing shadow copies through the built in volume shadow copy administration tool; issuing the equivalent command through Windows Management Instrumentation scripting; or, in a subtler variant, shrinking the storage quota reserved for shadow copies until the operating system automatically purges older snapshots to make room. Some ransomware families go further still, rebooting the target machine into Safe Mode before encrypting, a mode in which many endpoint protection products and antivirus engines simply do not load, giving the encryptor a clear run with minimal interference. Because this destructive step leaves a distinctive trace in system logs, security teams frequently treat any unexpected shadow copy deletion command as one of the strongest and most reliable warning signs available, worth an immediate investigation rather than a routine alert.
Attackers who have gained domain administrator rights during the lateral movement stage often extend this sabotage to network based backup systems as well, targeting backup servers directly so that even centralized, off host copies of company data become unusable by the time encryption begins.
The Encryption Phase and Why Data Theft Comes First
Encryption is usually one of the final actions in the intrusion, not the opening move, and by the time it happens the attacker has typically already exfiltrated a substantial volume of sensitive data. This step exists because encryption alone stopped being sufficient leverage once organizations began maintaining reliable offline backups. If a victim can restore from backup, encrypted files stop being useful bargaining chips. Stolen data does not have that weakness, since a copy sitting on the attacker's own infrastructure cannot be restored away. This approach is generally described as double extortion: pay to get a decryption key, and pay again to prevent stolen files from being published. The categories of data attackers prioritize for theft tend to include financial records, customer information, intellectual property, and anything that could embarrass the organization publicly if leaked.
The technical execution of encryption itself has grown more sophisticated in recent ransomware families. Rather than encrypting an entire file with a single key, modern encryptors frequently generate a unique key per file, then wrap that key using an attacker controlled public key so that only the attacker's matching private key can unlock it. To keep the process fast enough to encrypt an entire network before defenders can respond, several documented strains only encrypt scattered chunks of larger files rather than their full contents, trading completeness for speed since even a partially scrambled file is generally unusable. Analysts have also noted a shift toward encryptors written in newer, cross platform programming languages, which lets a single ransomware codebase target Windows, Linux, and virtualization servers with only minor adjustments, widening the blast radius of a single successful intrusion.
What the Modern Timeline Looks Like and Why Speed Now Decides Outcomes
The most striking shift in recent ransomware activity is not a new technique but a dramatically compressed timeline. Threat intelligence teams reported that the fastest recent intrusions reached the data exfiltration stage in roughly seventy two minutes from initial access, down sharply from close to five hours the year before. Industry tracking has also identified well over one hundred forty distinct ransomware brands active in a single recent period, a figure that reflects how fragmented and commercialized the ransomware ecosystem has become, with many groups operating as loosely affiliated networks of independent operators rather than single, centralized organizations.
This compression fundamentally changes what effective defense looks like. A response plan built around detecting the loud, final stage of an attack, the moment files actually start encrypting, arrives far too late when the entire intrusion from login to data theft can finish within an hour. The practical shift among security teams has been toward instrumenting the quiet early stages instead: unexpected logins from unusual locations, a workstation suddenly making dozens of new internal connections, LSASS memory access from a process that has no legitimate reason to touch it, and any command referencing shadow copy deletion. None of these individually proves an active ransomware intrusion, but together they form the pattern that shows up consistently across documented cases from Colonial Pipeline through the most recent incidents.
A few defensive priorities consistently separate organizations that contain an intrusion early from those that end up negotiating with an extortion group: enforce multi factor authentication on every remote access path, since a single unprotected account remains the most common opening across recent case studies; restrict administrative rights so that ordinary user accounts cannot execute shadow copy deletion commands in the first place; segment the network so that a single compromised workstation cannot reach every other machine over SMB or RDP; monitor specifically for credential dumping activity targeting the LSASS process; and maintain backup copies that are stored offline or in an immutable format the attacker cannot reach even after obtaining domain administrator credentials.
None of these controls guarantees immunity, and no vendor promise to stop ransomware outright should be taken at face value, since the intrusion techniques described above continue to evolve. What consistently changes outcomes is the gap between an attacker's foothold and a defender's first detection. Every stage described here, from the initial phishing email or exposed remote access account through credential theft, lateral movement, backup sabotage, and finally encryption, leaves traces in Windows event logs and network telemetry. The organizations that fare best are the ones actively looking for those traces long before a ransom note ever appears on a screen.