Threat analysis
Ransomware attack chain: exposed service to encryption
Reporting on ransomware usually covers only the last scene: the extortion note on the screen, the line that stopped, the sum demanded. But the decisive part of the ransomware attack chain happens one to three weeks earlier, and it is far more mundane than most people expect — no zero-day, no particular sophistication.
This article breaks the chain into stages and maps each one to a MITRE ATT&CK tactic, so you can walk your own environment through it stage by stage. By the end you should be able to answer a concrete question: if someone started on us today, where would they get in, and how much work would it take them to reach the encryption stage.
- Almost no detectable signal
- Medium signal
- Unmissable signal
Text version of this diagram
The six stages of the ransomware chain on one time axis, with the detectable signal at each stage drawn underneath.
The six stages
- Enumeration: ongoing, before the attack.
- Initial access: day 0.
- Internal discovery: days 1–3.
- Lateral movement and privilege escalation: days 3–14.
- Backups killed and data exfiltrated: days 14–20.
- Encryption: complete within hours.
The signal bars below
- The first three stages have the shortest bars: almost no detectable signal.
- Lateral movement and escalation rises to a medium signal.
- Killing backups and encryption are the two tallest bars — unmissable signal.
- The conclusion: the attacker is inside for two to three weeks, and nearly all the detectable signal falls in the last day or two.
The chain does not start with encryption, it starts with finding an address that answers
The chain opens with initial access (TA0001), and the work preceding initial access is enumeration: sweep public address ranges, record which addresses and ports respond, and fingerprint what the response looks like — which product, which version.
That work is automated, continuous and extremely cheap. It is not aimed at you; it is aimed at every address that answers. The size of your attack surface is simply how many times you appear in that internet-wide list.
The list is then joined against vulnerability data. The CISA Known Exploited Vulnerabilities catalog is the most practical version of that join: every entry has been confirmed as exploited in the wild, and remote access appliances have always been heavily represented in it.
One sentence worth keeping: an address that does not answer never enters the list. Everything below rests on that.
The three entrances that account for most intrusions
The ways in do not vary much. Broadly, there are three.
| Entrance | What the attacker needs | Technique |
|---|---|---|
| A known flaw in a public service | A reachable endpoint and an exploit | T1190 |
| Working credentials | Bought or guessed | T1078, T1110 |
| A person reading email | A convincing enough message | T1566 |
Exploiting a public-facing application (T1190) takes the least effort. VPN gateways, remote desktop portals, file transfer systems, management consoles — anything open to the whole internet is simultaneously a service entrance and an attack entrance.
Valid accounts (T1078) is the hardest to detect, because the account is genuine. Credentials may come from brute force (T1110), from a breach on some unrelated site, or straight from an initial access broker — there is now an entire market in working VPN credentials for named companies.
Phishing (T1566) and social engineering bypass technical controls and deal with people directly. Training lowers the rate but never to zero, so no architecture should assume nobody clicks.
All three paths share an endpoint: the attacker holds a foothold inside the network, and in most cases the credentials they hold are legitimate.
- Attack path
- Holding legitimate credentials
Text version of this diagram
Three entrances lead to the same internal foothold, and nothing after that foothold has to be broken through again.
Left — the three entrances
- A known flaw in a public service, ATT&CK T1190.
- Working credentials, T1078 and T1110.
- A person reading email, T1566.
- All three arrows converge on a single point.
Centre — the internal foothold
- The junction is labelled "internal foothold", annotated with T1078.
- Below it, highlighted: in most cases the attacker holds legitimate credentials.
Right — everything after
- Inside a dashed box, in order: internal discovery, lateral movement, encryption and leak.
- The conclusion: all three paths end in the same place, and nothing after it has to be broken through.
What happens next: from one host to the whole domain
With a foothold established, the first job is orientation — network service discovery (T1046): sweep the internal ranges, list reachable hosts and services, locate the domain controllers and the backup servers.
Traditional networks barely resist this step. A VPN issues an internal address after authentication, so what the attacker can see equals what that segment can see. They then use remote services (T1021) — RDP, SMB, WinRM, all already open internally — to move host by host, the stage known as lateral movement (TA0008).
In most real incidents, days to weeks pass between initial access and domain administrator privileges. During that time the attacker’s activity looks a great deal like a new IT hire finding their way around, which is precisely why it goes unnoticed.
The architectural dividing line sits here: is reachability determined by network location, or by identity? In the first case a stolen credential is worth an entire segment; in the second it is worth only the handful of services that identity was granted. The mechanism behind that difference is described in how a zero trust network actually works.
Why antivirus and backups still end in an extortion note
Because encryption is the last scene, and by then the attacker is an administrator.
- Backups are dealt with first. A backup host in the same domain, using the same administrative credentials, mounting a writable share, is inside the attacker’s reach. Deleting snapshots and stopping backup services (T1489) before encryption is standard practice.
- Antivirus only fires at the loudest step. The preceding weeks run on legitimate tools and legitimate accounts, which produce very few detectable signals.
- Encryption is just the closing move. Data encrypted for impact (T1486) typically completes within hours, and most cases now exfiltrate data first — so even a clean restore leaves you with a data breach.
“Can we recover” and “will this hurt us” are therefore two different questions. Backups answer the first one only. For preparation, response and recovery process, NIST SP 800-61 is the reference; regional advisories and threat intelligence come from bodies such as ENISA and, in Taiwan, TWCERT/CC.
Which link in the chain is cheapest to break
Line the stages up against the cost of defending each one and the answer is not subtle.
| Stage | Usual defence | The difficulty |
|---|---|---|
| Enumeration | Do not answer unauthorised requests | Requires architectural change, once |
| Initial access | Patching, MFA, training | Continuous, never reaches 100% |
| Internal discovery | Segmentation, microsegmentation | Rule sprawl, high maintenance |
| Lateral movement | Detection and response | Needs staffed, tuned monitoring |
| Encryption | Backups and restore drills | Limits loss; the event happened |
The higher up, the cheaper — because higher up you are defending a single variable, reachability. Lower down you are defending against attacker behaviour, and behaviour has unlimited variations.
- One-time cost
- Continuous upkeep
- Staffed watch or after-the-fact recovery
Text version of this diagram
Five stages from top to bottom, each row naming what is defended and at what cost; cost is the length of the bar, growing downward.
The five rows
- Enumeration: defends reachability — one variable — at a one-time cost.
- Initial access: defends flaws and credentials, which keep moving, at a continuous cost.
- Internal discovery: defends segments and rules, which keep growing, at high upkeep.
- Lateral movement: defends against attacker behaviour, unlimited in variation, needing a staffed watch.
- Encryption: already happened; only the loss can be limited.
What to take from it
- The top row has the shortest bar in the safe colour; the bottom two are longest and in the risk colour.
- Higher up there are fewer variables to defend; lower down you defend behaviour, and behaviour has unlimited variations.
That is the concrete relevance of zero trust architecture to ransomware. It does not claim to stop phishing; it collapses the first and third stages at once. Services do not answer unauthorised requests, so they never enter the enumeration list; authentication grants a single service rather than a segment, so the lateral path is not there to begin with. How the architectures differ on those two points is set out in comparing traditional VPN, gateway-based ZTNA and SDP.
Five things you can check today
No tooling and no project budget required.
- List every port your organisation exposes publicly and ask of each one whether it truly has to be open to the world. The list is usually longer than IT remembers.
- Confirm MFA is enforced on all remote access, vendor and contractor accounts included.
- Verify at least one backup copy is offline or immutable, and reachable without day-to-day administrative credentials.
- Run an actual restore, rather than reading a successful-backup log.
- Take an ordinary employee account and ask how many hosts it can reach. If the answer is “the whole segment”, the lateral path is already paved.
If items 1 and 5 both come back badly, the priority is architecture rather than procurement — which is what choosing a VPN replacement and planning the migration covers. Establishing how far an attacker could actually get is the scope of red team versus penetration testing.
Terms and further reading
| Term | In one sentence | Source |
|---|---|---|
| Ransomware | Malware that encrypts data and demands payment | Ransomware |
| Initial access | The stage of gaining the first foothold | MITRE ATT&CK TA0001 |
| Attack surface | The sum of externally reachable entry points | Attack surface |
| Known Exploited Vulnerabilities | Vulnerabilities confirmed exploited in the wild | CISA KEV |
| Exploit public-facing application | Breaking in via a flaw in an exposed service | MITRE ATT&CK T1190 |
| Valid accounts | Logging in with real credentials | MITRE ATT&CK T1078 |
| Brute force | Repeated credential guessing until one works | MITRE ATT&CK T1110 |
| Initial access broker | A market intermediary selling network access | Initial access broker |
| Phishing | Forged messages that harvest credentials | MITRE ATT&CK T1566 |
| Social engineering | Manipulating people rather than systems | Social engineering |
| Network service discovery | Scanning internally for reachable services | MITRE ATT&CK T1046 |
| Remote services | Moving via remote protocols already in use | MITRE ATT&CK T1021 |
| Lateral movement | Spreading from one internal host to the next | MITRE ATT&CK TA0008 |
| Service stop | Halting backup or security services first | MITRE ATT&CK T1489 |
| Data encrypted for impact | Encrypting victim data to force payment | MITRE ATT&CK T1486 |
| Incident handling guide | Preparation, response and recovery process | NIST SP 800-61 |
| Zero trust architecture | Trust not derived from network location | What zero trust architecture is |
The technique identifiers above map directly onto detection rules, which makes them a quick way to find the stages where you currently have no signal at all. If you would like this chain assessed for feasibility against a specific environment, get in touch.