The ransom note is the last step, not the first. A typical intrusion runs for days or weeks before anything is encrypted. Understanding the sequence explains why backups fail, why paying rarely helps and where the evidence for recovery is found.
What happens. The attacker gets a first login. In 2025 the leading route was a stolen or brute-forced VPN password, accounting for close to half of incidents, ahead of phishing and unpatched public-facing software (firewalls, VPN appliances, Exchange, Citrix, file-transfer tools). Credentials are often bought from info-stealer logs on criminal markets.
Typical duration: minutes. Evidence: VPN and firewall logs.
What happens. A remote access tool or a legitimate administration product (AnyDesk, Atera, ScreenConnect) is installed so the attacker can return even if the password changes. Scheduled tasks and new services are created.
Typical duration: hours. Evidence: new software installs, unusual outbound connections.
What happens. The intruder moves from a normal user to a domain administrator, by dumping credentials from memory, abusing misconfigured Active Directory permissions or exploiting a local vulnerability. From this point, every machine that trusts the domain is reachable.
Evidence: security event logs, credential-dumping tool traces.
What happens. Network scanning and Active Directory enumeration to map servers, file shares, backup systems, hypervisors and databases. The attacker is deciding what is worth stealing and what must be encrypted to force payment.
Evidence: scanning traffic, enumeration tools such as AdFind, SharpHound.
What happens. Using the stolen administrator credentials, the attacker logs into servers over RDP, SMB, PsExec or WMI. Endpoint protection is disabled or uninstalled. Group Policy is often modified so the encryptor can later be pushed to every machine at once.
Typical duration: days to weeks. Evidence: authentication logs, disabled security agents.
What happens. Files are archived and uploaded to cloud storage or attacker servers. Roughly three quarters of ransomware attacks now include this step, which enables "double extortion": even a perfect backup does not prevent the threat to publish the data.
Evidence: large outbound transfers, archiving tools, cloud-storage clients.
What happens. Shadow copies are deleted, backup jobs are stopped, backup repositories and ESXi datastores are encrypted first, then the encryptor is pushed across the network, usually at night or before a weekend. Modern encryptors use intermittent encryption, touching only parts of each file so that terabytes can be locked in an hour.
Evidence: this is the moment the incident becomes visible.
What happens. Ransom notes appear in every folder with a link to a negotiation portal on the Tor network. A countdown begins. If the victim does not engage, samples of stolen data are published on a leak site and the pressure escalates through calls to executives, customers and journalists.
Every stage leaves artefacts on disk and in memory. A-Lab's assessment uses them to identify the exact encryptor build, which determines the recovery method.
The period between initial access and encryption. Typically several days to a few weeks. This is the window in which detection prevents the incident, and the reason why "we had antivirus" is rarely enough.
Encryption plus data theft is double extortion. Adding denial-of-service attacks or direct pressure on customers and partners is triple extortion. The technical recovery of data addresses the first layer; the second requires legal and communications handling.
Encrypting one ESXi host takes every virtual machine on it offline in a single action. That is why Qilin, Akira, Medusa and Play all ship dedicated Linux/ESXi encryptors, and why virtual disk reconstruction is central to modern recovery.