Ransomware

Ransomware evolved from a nuisance into the dominant existential threat to small businesses over the last decade. The modern variant is rarely just encryption — most ransomware groups now run “double extortion”: they exfiltrate sensitive data before encrypting it, then threaten to publish or sell the data even if the victim restores from backup. The financial damage from a single successful attack routinely runs into hundreds of thousands of dollars even before the ransom itself.

The modern attack chain

A ransomware deployment is the end of a multi-step intrusion, not the beginning. Understanding the chain is how you defend against it.

1. Initial access — usually phishing (stolen credentials) or an unpatched vulnerability on an internet-facing system
2. Persistence + reconnaissance — attacker establishes a foothold, looks around, identifies the most valuable systems
3. Privilege escalation — using stolen credentials or local vulnerabilities to gain administrator access
4. Lateral movement — pivoting through the network to reach backup systems, file servers, databases
5. Exfiltration — copying valuable data out for the second extortion layer
6. Encryption — only at the very end, often timed for a weekend or holiday to maximize pressure

The encryption itself is the loudest, fastest, most visible step. Everything before it is quieter — and stoppable.

Layered defense

No single product stops ransomware. The defenders that survive these attacks have layered controls that interrupt the chain at multiple points:

• MFA everywhere stops most initial-access attempts at the credential step
• Aggressive patching closes the unpatched-vulnerability vector
• Email security + awareness training catches the phishing that started it
• EDR with file-rollback catches the malware before encryption completes
• Network segmentation limits lateral movement once an attacker is in
• Privileged access management prevents single-credential compromise from becoming full-domain compromise
• Immutable, tested backups ensure the encryption step doesn’t cost you the business — provided you’ve also verified offline copies exist that the attacker couldn’t reach

Most clients we onboard have two or three of these layers; few have all of them. The work of an MSP, in practice, is closing those gaps before the chain runs.