The public image of ransomware is a single catastrophic moment: screens lock, a ransom note appears. In reality, that moment is the end of an operation that typically ran for days or weeks inside the network — and every earlier stage was a chance to catch it. Walking the chain stage by stage is one of the most instructive exercises in all of security, because nearly every concept from this trail shows up along the way, playing its position.
Stage 1: Initial access
Attackers get in through one of a familiar trio: a phishing email delivering a trojan (the phishing and malware posts, in the wild), stolen credentials on a remote-access service without MFA (the passwords post, ignored), or an unpatched internet-facing system (the patching post, ignored). Increasingly there's a division of labour: initial access brokers breach networks wholesale and sell the footholds to ransomware crews. The person who broke in is often not the person who will encrypt you.
Stage 2: Foothold and persistence
First priority inside: don't get evicted. Malware installs itself to survive reboots, and attackers frequently add quieter insurance — creating accounts, or installing the same legitimate remote-management tools IT uses, which blend into normal noise beautifully. This stage is patient and deliberately boring.
Stage 3: Escalation and lateral movement
A foothold on one workstation is nearly worthless; the crown jewels need admin rights on everything. So attackers harvest credentials from memory, hunt for over-privileged accounts (least privilege's revenge), Kerberoast weak service accounts, and move east-west through the flat internal network — every hop a bet that nobody's watching internal traffic (the microsegmentation post's entire thesis). The strategic prize is domain admin, and with it, one target above all: the backups. Modern crews locate and destroy backup infrastructure before revealing themselves, because backups are the victim's alternative to paying.
Stage 4: Exfiltration — the quiet theft
Before encrypting anything, gigabytes of the most sensitive data flow out — sometimes disguised as innocent traffic (the DNS tunnelling post, weaponised). This is double extortion: pay to decrypt, and pay again so the data isn't published. It's why "we restored from backups" no longer ends the incident, and why these events are now data breaches with legal obligations, not just outages.
Stage 5: Detonation
Only now — often at 2am on a holiday weekend, when response is slowest — does encryption launch everywhere simultaneously, and the note appears. The stage everyone pictures is the last five percent of the operation.
Now reread the chain as a defender and notice: every stage has a tripwire. MFA and patching gate stage 1. New accounts and odd remote tools light up in logs at stage 2. Credential harvesting and lateral movement trip endpoint detection and impossible-travel alerts at stage 3. Massive outbound transfers scream at stage 4. Offline, immutable backups defang stage 5. This is why defence-in-depth isn't a platitude — the attack is a chain, and a chain breaks at any link. The famous framework name for mapping all this is MITRE ATT&CK, and having walked one chain, you now know how to read it.