How it started
It began the way most of these cases do: an employee received an email that looked like an internal IT notice, warning that their VPN password was about to expire. The link led to a convincing lookalike login page. The employee entered their credentials, noticed nothing unusual, and went on with their day.
That single login — no malware, no exploit, just a stolen password — was the entire initial access phase. The account had no multi-factor authentication configured, which meant a username and password were sufficient to get in.
The 72-hour timeline
A quiet, unremarkable login
The attacker logs in through the VPN using the stolen credentials from a residential proxy IP, blending in with normal remote-access traffic. No alert fires — the login pattern doesn't look different enough from a typical remote employee session.
The window where this was still stoppable
Over the next three days, the attacker moves laterally through the network using legitimate admin tools already present in the environment (a technique often called "living off the land"). They locate and quietly disable backup jobs, and eventually obtain domain admin credentials through a misconfigured service account.
This is the single longest and most important phase in almost every ransomware case: the dwell time between initial access and encryption. It is also the phase where detection engineering and threat hunting have the most leverage — unusual admin tool usage, backup service tampering, and irregular authentication patterns are all detectable if the right rules and hunts exist.
Encryption across the environment
With backups disabled and domain admin access secured, the ransomware payload deploys across servers and endpoints in a matter of minutes. Finance systems, the ERP platform, and production-line control systems all go dark simultaneously. A ransom note appears on every affected screen.
Containment, rebuild, and the harder conversations
The incident response team isolates affected network segments, confirms the scope of the compromise, and begins rebuilding from the one set of backups the attacker didn't find. In parallel, legal counsel and communications teams work through disclosure obligations, customer notifications, and — in many real cases — the decision of whether to engage with the ransom demand at all.
Partial operations resume around day nine. Full recovery, including rebuilding trust with customers and partners, takes considerably longer.
Where this could have been stopped
Cases like this rarely come down to one single failure — they come down to a short list of gaps that, individually, seem survivable:
- No MFA on remote access. A single stolen password should not be enough to get in. MFA would have stopped this at the very first step.
- No alerting on backup service changes. Backup jobs being disabled is a strong, specific signal — and one of the highest-value detections a team can build.
- No hunting for living-off-the-land admin tool usage. The three-day escalation window relied on tools already trusted in the environment. Baseline-deviation hunts catch this kind of activity even when there's no malware signature to detect.
- Flat network segmentation. Lateral movement from a single compromised account to domain admin was faster than it should have been in a properly segmented environment.
None of these are exotic controls. They're the same fundamentals that come up in nearly every ransomware post-mortem — which is exactly why they're worth getting right before an incident, not after.
The takeaway for your business
Ransomware doesn't usually start with something dramatic. It starts with one login, one missing control, and a few quiet days where nothing looks wrong yet. That silent window is where the outcome gets decided — long before the ransom note appears on the screen.
For a business, the cost isn't just downtime. It's the finance and production disruption, the customer and partner trust that takes far longer to rebuild than the systems themselves, and — in many cases — regulatory and legal exposure on top of it. The teams that come out the other side with the least damage are consistently the ones with basic detection and hunting capability in place before day zero.