KD-008 // RANSOMWARE INCIDENT ANALYSIS MISSION 003

HOUSE VENTER // CYBERSECURITY INTELLIGENCE

What Actually Happens When Your Computer Gets Ransomware?

Ransomware is often described as malware that encrypts files and demands money. That description is useful, but incomplete. A modern ransomware incident can involve stolen credentials, persistent access, movement through an environment, data theft, encryption and deliberate attempts to make recovery more difficult.

Encryption may be the moment everybody notices the attack. It may not be the moment the attack began.

KD-008 // INCIDENT CHAIN SIMPLIFIED ATTACK & RESPONSE MODEL

01ENTRY

02FOOTHOLD

03DISCOVERY

04DATA THEFT

05ENCRYPTION

06RESPONSE

07RECOVERY

ATTACK PATH // NOT EVERY INCIDENT FOLLOWS THE SAME SEQUENCE OBJECTIVE // REDUCE RISK • CONTAIN • RECOVER

KD-008 // EXECUTIVE BRIEF THE RANSOM NOTE IS NOT THE WHOLE STORY

Ransomware Is an Incident — Not Just an Encrypted File

Ransomware is malicious activity in which attackers can encrypt data and demand payment to restore access. Modern incidents may also involve stealing information and threatening to disclose it as additional leverage.

This means the visible symptom — inaccessible files or a ransom demand — can represent only one stage of a wider compromise.

Understanding that sequence matters because prevention, detection, containment and recovery are different responsibilities. No single product performs all of them.

CENTRAL QUESTION What may have happened before the ransom note appeared — and what should happen after it does?

INITIAL ACCESS

The Attack Has to Get In Somehow

A ransomware incident begins with some form of access. That access may come through compromised credentials, phishing or social engineering, exposed remote services, vulnerabilities, precursor malware or another compromised path.

The exact route varies. The important point is that ransomware does not need to begin with somebody deliberately downloading a file called “ransomware.”

An attacker may first obtain credentials or establish another foothold and only deploy ransomware later.

ENTRY // 01Compromised Credentials

Stolen or reused credentials can provide access to systems or services.

ENTRY // 02Social Engineering

Phishing and other deceptive techniques can persuade users to reveal access or execute malicious content.

ENTRY // 03Vulnerabilities

Unpatched or exposed systems may provide an attacker with another route into an environment.

ENTRY // 04Precursor Malware

Earlier malware activity can establish access that is later used for ransomware deployment.

ENTRY PRINCIPLE

The ransomware payload may be late in the attack chain. The original compromise can happen before encryption becomes visible.

FOOTHOLD

Access Can Become Persistence

Once attackers obtain access, they may attempt to preserve it long enough to understand the environment and prepare later actions.

Depending on the incident, that can involve malicious software, abused legitimate tools, compromised accounts, remote-access mechanisms or other persistence techniques.

This is one reason a ransomware event can be evidence of a broader compromise rather than an isolated file-encryption event.

STAGE // 01Access

An attacker obtains a usable path into a device, account or environment.

STAGE // 02Persistence

The attacker may attempt to maintain access and avoid being removed prematurely.

STAGE // 03Preparation

Access can be used to gather information and prepare subsequent activity.

DISCOVERY & MOVEMENT

The Attacker May Look Around Before Making Noise

In more developed compromises, attackers may investigate systems, accounts, data, network relationships and available privileges before the disruptive stage begins.

They may also attempt to move from one compromised system to others. The amount of movement possible depends on the environment, access available and security controls in place.

The practical lesson is simple: the first encrypted computer discovered may not necessarily be the only system involved.

INCIDENT PRINCIPLE

When ransomware is discovered, response should consider the scope of the compromise, not only the device displaying the ransom note.

DATA EXTORTION

Modern Ransomware Can Involve More Than Encryption

Some ransomware operators steal information before or alongside encryption. The stolen information can then become a second source of pressure.

Instead of only saying “pay to regain access,” an attacker may also threaten to publish or disclose stolen information.

This changes the recovery conversation. Restoring files from backup can help restore operations, but a backup cannot make already stolen information become un-stolen.

EXTORTION MODEL // SIMPLIFIEDTWO DIFFERENT IMPACTS

IMPACT // AVAILABILITY Encryption

Data or systems become unavailable, creating operational disruption and a need for restoration or rebuilding.

IMPACT // CONFIDENTIALITY Data Theft

Information may leave the organisation, creating a separate confidentiality, legal and business concern.

BACKUP BOUNDARY

Backup is essential for recovery, but backup is not data-loss prevention. Recovery capability and prevention of unauthorised disclosure are different security objectives.

DISRUPTION

Encryption Is Where the Attack Becomes Impossible to Ignore

During the disruptive stage, ransomware may encrypt accessible information or otherwise interfere with systems and business operations.

Attackers may also attempt to damage or remove recovery options that are accessible from the compromised environment. This is why backup design matters: a backup that can be reached and altered through the same compromised path may itself become a target.

At this point users may encounter inaccessible files, changed filenames, unusual extensions, failed applications, unavailable systems or a ransom demand.

IMPACT // 01Files Unavailable

Important data may no longer open or operate normally.

IMPACT // 02Operations Disrupted

Applications, workflows and staff productivity can be interrupted.

IMPACT // 03Recovery Targeted

Accessible backup or recovery mechanisms may also be attacked in some incidents.

THE RANSOM DEMAND

The Message Is Designed to Create Pressure

A ransom demand attempts to turn technical disruption, stolen information or both into leverage. The victim may be told that payment will produce a decryption mechanism, prevent disclosure, or otherwise resolve the incident.

The existence of a demand does not prove that the attacker can restore every affected system, has deleted stolen data, or will honour every promise made.

Decisions involving extortion payments can carry legal, financial, operational and law-enforcement considerations. They should not be treated as a simple technical purchase decision.

DECISION BOUNDARY

The ransom note is written by the attacker, not by a trusted recovery provider. Claims made inside it should not be treated as guarantees.

FIRST RESPONSE

Containment Comes Before Normal Operations

When ransomware is suspected or confirmed, the first priority is not to carry on working normally and hope the problem remains on one computer.

Current CISA ransomware guidance begins by determining which systems were affected and immediately isolating them. Isolation can help limit further spread while the incident is assessed.

Response also needs to preserve enough information to understand what happened. Simply wiping every affected computer immediately can destroy evidence that may be useful for identifying the original compromise or determining whether malicious access remains.

INCIDENT RESPONSE // FIRST ACTIONSCONTAIN BEFORE RESTORE

01ISOLATE

Disconnect affected systems from network paths where practical.

02IDENTIFY

Determine which systems, accounts and services may be involved.

03PRESERVE

Retain useful logs and evidence where appropriate before destructive cleanup.

04PRIORITISE

Decide which critical systems and services need controlled recovery first.

IMPORTANT

This is a general educational sequence, not a substitute for an incident-response plan. The correct response depends on the environment and the incident.

RECOVERY

Recovery Is More Than Copying the Files Back

Restoring data is important, but recovery should take place into an environment that has been appropriately cleaned, rebuilt or otherwise secured.

If the original access path, compromised account or malicious persistence remains, restoring data alone can leave the organisation exposed to continued compromise or reinfection.

CISA guidance therefore includes rebuilding affected systems where appropriate, addressing compromised accounts and security gaps, and restoring data from protected backups according to business priorities.

RECOVERY // 01Clean

Remove or rebuild compromised systems and address malicious persistence.

RECOVERY // 02Secure

Address compromised credentials, vulnerabilities and identified security gaps.

RECOVERY // 03Restore

Recover appropriate systems and data from validated recovery sources.

RECOVERY // 04Verify

Confirm restored systems are functioning and continue watching for signs of compromise.

THE BACKUP QUESTION

If You Have Backup, Are You Safe From Ransomware?

Backup can be one of the most important recovery capabilities in a ransomware incident. It can create a path to restore data without depending entirely on the attacker.

But backup does not stop malicious code from executing, does not prevent credentials from being stolen and does not reverse data that has already been exfiltrated.

Backups themselves also need appropriate protection and testing. CISA recommends maintaining protected backup copies and regularly testing their availability and integrity because some ransomware attempts to delete or encrypt accessible backups.

BACKUP // WHAT IT DOES & DOES NOT DORECOVERY ≠ PREVENTION

BACKUP CAN HELP Create Recovery Options

A valid, protected backup can help restore appropriate data and support business recovery.

BACKUP CANNOT Undo the Entire Incident

It cannot erase stolen data, guarantee containment or remove the original cause of compromise.

RISK REDUCTION

What Actually Reduces Ransomware Risk?

There is no single switch that makes ransomware impossible. Effective risk reduction comes from multiple controls working together.

Current guidance from NIST and CISA spans governance, asset awareness, identity and access controls, patching, endpoint protection and EDR, monitoring, user awareness, protected backups, incident response and recovery planning.

The objective is not to promise immunity. It is to reduce the likelihood of compromise, improve the chance of detecting suspicious activity, limit impact where possible and preserve a credible recovery path.

CONTROL // 01Identity & Access

Strong authentication, least privilege and appropriate account controls reduce unnecessary access.

CONTROL // 02Patching & Hardening

Address known vulnerabilities and reduce avoidable exposure in supported systems.

CONTROL // 03Endpoint Security

Appropriate security controls can help prevent, detect or respond to malicious activity.

CONTROL // 04Monitoring

Useful telemetry and alerts can improve visibility into supported technology.

CONTROL // 05Protected Backup

Maintain recovery copies designed to remain useful when primary data is damaged or unavailable.

CONTROL // 06Incident Readiness

Know how isolation, investigation, communication and recovery will be handled before an emergency.

KD-008 // FIELD CONCLUSION INCIDENT CHAIN UNDERSTOOD

FINAL ASSESSMENT

So What Actually Happens When Ransomware Hits?

Sometimes the visible event is rapid. In other incidents, attackers may have already established access, explored the environment or stolen information before encryption begins.

The ransom note therefore should not be viewed as the beginning of the story. It is a signal that an incident has reached a point where disruption or extortion has become visible.

Good ransomware preparation is not built around one product or one promise. It is built around reducing risk, improving visibility, containing incidents and preserving the ability to recover.

KNOWLEDGE DOCK // FINAL PRINCIPLE

Reduce the opportunity. Detect what you can. Contain deliberately. Recover from a position of preparation.

HOUSE VENTER // FIELD APPLICATION RANSOMWARE RESILIENCE // FOUR PILLARS

LAYERED RESPONSIBILITY

The Four Pillars Address Different Parts of the Problem

House Venter does not present the Four Pillars as a guarantee that ransomware cannot happen. Their value is that they create different layers of protection, visibility, recovery capability and human support around managed technology.

No pillar replaces the others. Endpoint security is not backup. Monitoring is not incident immunity. Backup is not prevention. Support is not a substitute for security controls.

01 // PROTECTING Endpoint Security / EDR

Reduce risk and provide security capability around supported endpoints.

02 // MONITORING RMM & Visibility

Create ongoing visibility and management capability around supported technology.

03 // BACKING UP Managed Cloud Backup

Maintain an appropriate managed recovery path for included data and systems.

04 // SUPPORTING Human IT Support

Provide technical response, troubleshooting and recovery assistance when intervention is required.

KD-008 // INTELLIGENCE SUMMARY

Six Points to Remember

INTEL 01Encryption May Be Late

The visible ransomware event can occur after earlier compromise activity.

INTEL 02Data May Be Stolen

Some incidents combine encryption with data theft and disclosure threats.

INTEL 03Scope Matters

The first affected computer discovered may not be the only system or account involved.

INTEL 04Isolation Matters

Containment helps limit further spread while the incident is assessed.

INTEL 05Backup Is Recovery

Protected backups can create recovery options but do not undo every consequence of compromise.

INTEL 06Layers Matter

Ransomware resilience depends on multiple controls and a deliberate response process.

UNDERSTAND THE ATTACK. DEFINE THE RESPONSE. PREPARE THE RECOVERY.

KD-008 // RESEARCH REFERENCES

Technical framing reviewed against NIST IR 8374 Rev. 1, Ransomware Risk Management: A Cybersecurity Framework 2.0 Community Profile (June 2026). NIST CSRC

Incident-response and backup guidance reviewed against the joint CISA #StopRansomware Guide. CISA