By Joe Seanor, CISSP | Cyber Investigator & Network Security Expert.

Most people think a ransomware attack starts with a lock screen and ends with a ransom note.

The truth? That’s step six in a much longer, more dangerous game.

When I respond to ransomware incidents, I don’t just look at the files that were encrypted. I look at the entire path the attackers took to get there. And what I find is always the same: a systematic, strategic process that follows a disturbingly predictable playbook.

Today, I’m going to show you exactly what cybercriminals do once they get into your network—so you can recognize the warning signs before it’s too late.

Step 1: Initial Access – The Quiet Entry

Attackers don’t kick down the door. They slip in quietly.

Common methods include:

• Phishing emails with malicious attachments or links
• Stolen credentials bought on the dark web
• Exploiting vulnerabilities in VPNs, RDP, or unpatched servers

Once inside, they plant a backdoor or remote access tool (like Cobalt Strike or AnyDesk) to stay connected.

Step 2: Reconnaissance – Map the Network

Before making a move, attackers learn everything they can about the environment.

They:

• Scan for open ports, shares, and admin accounts
• Locate key systems: backups, domain controllers, file servers
• Identify antivirus or EDR solutions to avoid detection

Think of this as building the blueprint for an inside job.

Step 3: Privilege Escalation & Lateral Movement

Now they start moving from machine to machine, collecting more access.

Tactics include:

• Harvesting admin passwords from memory (via Mimikatz)
• Using RDP to jump between systems
• Leveraging Group Policy or PowerShell to deploy tools silently

In many cases I’ve investigated, attackers roamed undetected for weeks, preparing for maximum impact.

Step 4: Data Exfiltration – Steal Before You Lock

Here’s what most victims don’t realize:
Hackers steal your sensitive data before encrypting it.

They upload it to external servers or cloud drives:

• HR files, financials, client contracts
• Email archives and source code
• Legal and compliance records

This is the “double extortion” phase—they’ll threaten to publish your data if you don’t pay

Step 5: Ransomware Deployment – Game Over?

Once they’ve taken everything they need, they trigger the encryption payload.

This is often done late at night or on a weekend to avoid detection.

Key actions:

• Encrypt data across the network
• Delete backups or snapshots
• Drop ransom notes on every system

Suddenly, everything grinds to a halt—and the business faces a critical decision.

Step 6: The Ransom Demand

Now comes the shakedown.

Ransom demands can range from a few thousand to millions of dollars, payable in cryptocurrency. Attackers often:

• Offer a “support line” via chat
• Provide proof of decryption capabilities
• Threaten to leak stolen data on public sites

Some even negotiate, lowering the price if you respond quickly.

The Psychological Game

It’s not just a technical attack—it’s psychological warfare.

Victims are:

• Panicked about downtime
• Afraid of reputational damage
• Unsure what was taken or what’s safe

Hackers exploit this fear to pressure victims into paying quickly.

How to Disrupt the Ransomware Playbook

Stopping ransomware is about breaking the chain before the payload drops.

Protect Your Entry Points

• Use strong email security and phishing training
• Patch VPNs, RDP, and public-facing systems

Monitor for Recon and Lateral Movement

• Deploy EDR/XDR tools with behavioral detection
• Watch for unusual account logins or PowerShell activity

Segment Your Network & Secure Backups

• Limit access to sensitive systems
• Keep offline, immutable backups

Have an Incident Response Plan

• Test your ransomware playbook—before you need it
• Know who to call, what to isolate, and how to communicate

Final Thoughts: It’s Not Just Malware—It’s a Business

Modern ransomware groups operate like companies:

• They outsource access to affiliates
• They use help desks and SLAs
• They invest in tooling and negotiation strategies

You need to treat ransomware like a hostile business takeover—and prepare accordingly.

Stay secure,

Joe Seanor

CISSP | Private Cyber security Consultant