The Anatomy of a Ransomware Attack

"The Multi-Million Dollar Click"

It starts with a single email. An employee, perhaps in a rush, clicks a link in what looks like a routine invoice. Within days, an entire global corporation's operations grind to a halt.

But in reality, Ransomware is usually the last 10% of the operation.

The battle is often won or lost days or weeks before the red screen appears. The critical moments happen when credentials are stolen, when the attacker moves laterally to a new server, or when they quietly disable your backups.

Industry Concept: Staying "Left of Boom"

In cybersecurity, the "Boom" is the moment of impact—in this case, the encryption of your data.

• Right of Boom: Reactive mode. Incident response, backups, and damage control.
• Left of Boom: Proactive mode. Using frameworks like ATT&CK and D3FEND to detect and disrupt the attacker before they can pull the trigger.

In this guide, we will perform a "medical deconstruction" of a modern ransomware attack. We will map every stage to the Cyber Kill Chain, identify the specific techniques using MITRE ATT&CK, and prescribe the cure using MITRE D3FEND.

Pro Tip: Always preserve logs and forensic images. They are your best chance at understanding the attack vector and preventing future incidents.

Table of Contents

• Phase 0: Pre-Attack Setup (Access Brokers)
• Phase 1: Initial Access (Entry)
• Phase 2: Execution + Persistence (Establish)
• Phase 3: Privilege Escalation + Defense Evasion (Escalate)
• Phase 4: Credential Access (The Keys)
• Phase 5: Discovery + Lateral Movement (Expand)
• Phase 6: Exfiltration (Steal)
• Phase 7: Impact (Encrypt)
• Phase 8: Response Playbook
• The Full Map: At-a-Glance Playbook
• Conclusion

---

Phase 0: Pre-Attack Setup (Access Brokers)

🔴 High Risk

Before the main ransomware gang even gets involved, "Initial Access Brokers" are often paving the way.

• Objective: Obtain valid access to a network to sell it, or prepare infrastructure for the attack.
• Common ATT&CK Techniques:
  • External Remote Services (T1133): Identifying exposed VPNs or RDP ports.
  • Valid Accounts (T1078): Purchasing stolen credentials from the dark web.
  • Search Open Websites/Domains (T1593): Reconnaissance to find targets.
• Observable Signals: Repeated failed login attempts from unusual IPs, new accounts created, or scanning activity against your external perimeter.
• D3FEND Countermeasures:
  • Harden: Credential Hardening (D3-CH) and MFA (D3-MFA).
  • Detect: External Service Monitoring.

🛑 Breakpoint Action:

• Enforce MFA on all external access points immediately.
• Audit your exposed service inventory weekly.

Phase 1: Initial Access (Entry)

🟠 Medium Risk

The door is opened. This is rarely just "one phishing email"—it's a multi-pronged assault.

Real-World Example: The Colonial Pipeline attack began with a single compromised VPN password that was found in a dark web data leak.

• Objective: Gain that first foothold on a single endpoint.
• Common ATT&CK Techniques:
  • Phishing (T1566): Spearphishing links or attachments.
  • Exploit Public-Facing Application (T1190): Hitting a vulnerability in a web server or firewall.
  • Valid Accounts (T1078): Logging in via VPN with stolen creds.
• Observable Signals: Suspicious emails reported by users, unexpected child processes spawned by Office documents (e.g., Word launching PowerShell).
• D3FEND Countermeasures:
  • Detect: Message Analysis (D3-MA) for emails.
  • Harden: Exploit Protection and Patch Management.

🛑 Breakpoint Action:

• Isolate the affected host immediately.
• Reset the compromised user's password and terminate active sessions.

Phase 2: Execution + Persistence (Establish)

🟡 Medium Risk

The attacker is in. Now they need to ensure they stay in, even if you reboot.

• Objective: Execute malicious code and maintain access.
• Common ATT&CK Techniques:
  • User Execution (T1204): Tricking the user into running the malware.
  • Scheduled Task/Job (T1053): Setting a task to run the malware daily.
  • Boot or Logon Autostart Execution (T1547): Registry run keys.
• Observable Signals: New scheduled tasks with odd names, unauthorized registry changes, unknown processes connecting to the internet.
• D3FEND Countermeasures:
  • Detect: Process Analysis (D3-PA) and Endpoint Behavioral Monitoring.
  • Harden: Registry Monitoring (D3-RM).

🛑 Breakpoint Action:

• Identify and remove the persistence mechanism (task, key).
• Re-image the compromised machine to ensure no artifacts remain.

Phase 3: Privilege Escalation + Defense Evasion (Escalate)

🔴 High Risk

This is the turning point. The attacker tries to become an administrator and silence your alarms.

• Objective: Get admin rights and disable security tools (EDR/Antivirus).
• Common ATT&CK Techniques:
  • Impair Defenses (T1562): Disabling antivirus, killing EDR processes.
  • Privilege Escalation: Exploiting OS vulnerabilities to gain SYSTEM level access.
• Observable Signals: Security tools suddenly going offline, logs being cleared, or "access denied" errors for legitimate admins.
• D3FEND Countermeasures:
  • Detect: Service Modification Monitoring (alert if EDR service stops).
  • Harden: Least Privilege principles and tampering protection for security tools.

🛑 Breakpoint Action:

• If you see defense impairment, assume the host is fully compromised.
• Isolate it from the network instantly—seconds matter here.

Phase 4: Credential Access (The Keys)

🔴 High Risk

The attacker wants the keys to the kingdom—specifically, domain administrator credentials.

Real-World Example: The Lapsus$ group was notorious for their relentless focus on credential theft, often buying access or using social engineering to get the keys they needed to roam freely.

• Objective: Steal credentials to move to other systems.
• Common ATT&CK Techniques:
  • OS Credential Dumping (T1003): Dumping LSASS memory to get plain-text passwords.
  • Kerberoasting (T1558.003): Abusing Kerberos tickets.
• Observable Signals: Access to lsass.exe by non-system processes, unexpected use of admin accounts.
• D3FEND Countermeasures:
  • Harden: Credential Hardening (D3-CH) and Privileged Account Management.
  • Detect: Memory Analysis patterns.

🛑 Breakpoint Action:

• Reset the Kerberos Ticket-Granting Ticket (KRBTGT) password.
• Force a password reset for all admin accounts immediately.

Phase 5: Discovery + Lateral Movement (Expand)

🟠 Medium Risk

They have the keys. Now they look for the treasure: your backups, file servers, and domain controllers.

• Objective: Map the network and spread to critical servers.
• Common ATT&CK Techniques:
  • Network Service Scanning (T1046): Finding open ports.
  • Remote Services (T1021): Moving via RDP or SMB/WinRM.
• Observable Signals: One computer connecting to many others (one-to-many traffic), logins to critical servers from workstations.
• D3FEND Countermeasures:
  • Detect: Network Traffic Analysis (D3-NTA).
  • Isolate: Network Segmentation (prevent workstations from talking to servers directly).

🛑 Breakpoint Action:

• Block lateral movement protocols (RDP/SMB) at the firewall level.
• Isolate the affected network segment to contain the spread.

Phase 6: Exfiltration (Steal)

🔴 High Risk

Double Extortion: Before they lock your files, they steal them to threaten a leak.

Real-World Example: The Conti ransomware group popularized double extortion, threatening to publish stolen data on their "shame site" if the ransom wasn't paid.

• Objective: Steal sensitive data to use as leverage.
• Common ATT&CK Techniques:
  • Exfiltration Over Web Service (T1567): Uploading to cloud storage (Mega, Dropbox).
  • Exfiltration Over C2 Channel (T1041): Sending data out via their backdoor.
• Observable Signals: Large outbound data spikes, connections to unauthorized cloud storage sites at odd hours.
• D3FEND Countermeasures:
  • Detect: Egress Anomaly Detection.
  • Harden: Proxy Controls and restricting outbound traffic.

🛑 Breakpoint Action:

• Cut internet access (egress) for the affected segment immediately.
• Preserve logs for evidence and legal/regulatory notification.
• Remember: The goal is to stop the attack before it reaches Phase 7. Every phase you can interrupt reduces damage, cost, and recovery time.

Phase 7: Impact (Encrypt)

🔴 High Risk

The "Boom." Files are locked, and the ransom note appears.

• Objective: Encrypt data and inhibit recovery.
• Common ATT&CK Techniques:
  • Data Encrypted for Impact (T1486): The ransomware execution.
  • Inhibit System Recovery (T1490): Deleting Volume Shadow Copies (backups).
• Observable Signals: High CPU/disk usage, mass file renaming, "vssadmin delete shadows" commands.
• D3FEND Countermeasures:
  • Detect: File Integrity Monitoring (D3-FIM).
  • Harden: Backup Protection (immutable/offline backups).

🛑 Breakpoint Action:

• Initiate full Incident Response plan.
• Verify backup integrity (do not connect backups to the infected network).

Phase 8: Response Playbook (What to Do)

Here is your emergency checklist based on where you caught the attack:

1. Detected in Phase 1-2 (Early): You are lucky. Isolate the host, reset the user's password, and hunt for the specific phishing email to purge it from other inboxes.
2. Detected in Phase 3-4 (Mid-Game): Assume admin compromise. Reset all admin credentials (including KRBTGT). Initiate a forest-wide password reset if necessary. Look for other compromised hosts.
3. Detected in Phase 6 (Exfil): The data is gone. Focus on legal/regulatory notification (GDPR, etc.). Cut outbound access immediately to stop further bleeding.
4. Detected in Phase 7 (Encryption): Damage control. Isolate the network to save what's left. Do NOT reboot encrypted machines (you might lose artifacts in memory). Engage your IR retainer.

Engaging an Incident Response (IR) retainer provides immediate, on-demand access to forensic experts to manage, contain, and remediate cyberattacks, typically within a guaranteed Service Level Agreement (SLA).

The Full Map: At-a-Glance Playbook

Conclusion: Breaking the Chain

Ransomware is terrifying, but it is not magic. It is a process. By understanding the anatomy of the attack, you realize that you have multiple opportunities to break the chain and stay "Left of Boom."

The Cyber Kill Chain helps you tell the story, MITRE ATT&CK gives you the technical details, and MITRE D3FEND provides the roadmap for your defense. A truly resilient organization doesn't just wait for the red screen—they hunt for the techniques and implement the countermeasures that stop the attack in its tracks.

Final Thought: Ransomware is a business for attackers. By understanding their playbook and implementing strong breakpoints, you can turn the tables and protect your organization from becoming the next headline.