The First 24 Hours: What Actually Happens When Ransomware Lands
Ransomware first-day response fails on decisions, not technique—attackers dwell 14 days, exfiltrate within hours, and target backups before encrypting. Median dwell time before encryption is 14 days, with initial access brokers handing off to ransomware crews in as little as 22 seconds. Attackers exfiltrate data within hours using legitimate admin tools and deliberately destroy backup infrastructure before deploying encryption.
Detection / Hunteropenrouter
Immediate Actions
- Disable VPN and external remote access paths lacking multi-factor authentication.
- Network-isolate affected hosts from EDR console, preserving memory.
- Reset krbtgt twice if credential theft is confirmed.
- Verify backup immutability or object lock is enabled today.
Key Takeaways
- Mandiant M-Trends 2026 reports median dwell time rose to 14 days from 11.
- Median gap between initial access and second-group hand-off collapsed to 22 seconds by 2025.
- CISA Akira advisory records exfiltration complete within two hours of initial access.
- Akira ransomware claimed approximately $244.17 million in proceeds as of late September 2025.
- UnderDefense engagement: ransomware reached 22 hypervisors before anyone picked up the phone.
Attack Chain
- Initial Access: Attacker enters via VPN without MFA and holds access for ~14 days
- Credential Access: Mimikatz and LaZagne dump credentials from LSASS; Kerberoasting targets service accounts
- Exfiltration: Data staged with WinRAR/FileZilla and transferred via RClone/WinSCP to Mega cloud storage; Ngrok tunnels traffic
- Defense Evasion: Volume shadow copies removed via PowerShell; backup infrastructure and cloud backups deleted
- Impact: Ransomware deployed across endpoints, file shares, domain controllers, and hypervisor clusters
- Persistence: Access broker leaves persistence behind for potential return after encryption event
Affected Systems
- VPN services without MFA configured
- Hypervisor clusters and virtualization management planes
- Domain controllers and identity services
- Backup infrastructure and cloud backup storage
- Network file shares
- Windows endpoints with volume shadow copies
Detection Availability
No detection rules or queries are published in the source article.
Detection Engineering Assessment
Hypotheses are starting points derived from the article, not findings about your environment; validate against your own telemetry.
| Dimension | Rating | Rationale |
|---|---|---|
| EDR Visibility | Medium | EDR detects mass file modification and injected processes but initial access often goes unnoticed for ~14 days. |
| Network Visibility | Medium | High-volume transfers to cloud storage via legitimate tools require volume and destination baselining, not signatures. |
| Detection Difficulty | Hard | Attackers use legitimate admin tools for exfiltration; 14-day dwell time with quiet initial access phase. |
Hunting Hypotheses
| Hypothesis | Telemetry | Stage | FP Risk |
|---|---|---|---|
| Hosts making outbound transfers of tens of GB to consumer cloud storage endpoints at unusual hours (T1567.002) | Firewall/proxy logs with destination and byte volume | Exfiltration | Low — large outbound cloud transfers rare in enterprises |
| Credential dumping from LSASS memory by any process other than known security tools (T1003.001) | EDR process telemetry and LSASS access events | Credential Access | Medium — security tools may legitimately access LSASS |
| PowerShell commands deleting volume shadow copies on multiple hosts simultaneously (T1490, T1059.001) | PowerShell script block logs and EDR process logs | Impact | Low — VSS deletion outside maintenance windows is suspicious |
| VPN logins without MFA followed by lateral movement or credential access activity (T1133, T1078) | VPN authentication logs and EDR process ancestry | Initial Access | Medium — legitimate VPN sessions also match this pattern |
Required Log Sources
- EDR process and file modification telemetry
- VPN authentication logs
- Proxy or NGFW outbound traffic logs
- Windows Security event logs (4624, 4672)
- PowerShell script block logging (4104)
- Backup system audit logs
Key Behavioral Indicators
- Mass file modification by single process across multiple hosts
- Single host pushing tens of GB to consumer cloud endpoint
- VPN sessions without MFA followed by credential access activity
- Volume shadow copy deletion via PowerShell on multiple hosts
- Ransom note files appearing on multiple hosts simultaneously
- Credential dumping tools executing from non-standard paths
Control Gaps
- Signature-based AV misses legitimate tools used for data exfiltration
- Backup systems authenticating to compromised domains fail silently
- Untested backups mean recovery time is unknown until attempted
- Unassigned decision authority delays containment actions by hours
- Service account passwords predating intrusion cannot rotate without outage
False Positive Assessment
Medium — attackers use legitimate admin tools like FileZilla, WinSCP, and RClone for exfiltration, requiring volume and destination baselining.
Recommendations
Suggestions to evaluate against your own environment, tooling, and incident-response procedures — not directives.
Infrastructure Hardening
- Enforce MFA on every remote access path into the estate.
- Separate backup system authentication from the production domain.
- Test full backup restoration end-to-end this quarter and time it.
- Retain domain controller logs covering at least 30 days.
User Protection
- Deploy EDR agents on all endpoints including hypervisor hosts.
- Restrict credential dumping tools via application control policies.
- Monitor for unusual outbound data volume to cloud storage endpoints.
Security Awareness
- Write three named decision-makers and deputies into IR plan.
- Run ransomware tabletop on Friday evening with real responders.
- Pre-negotiate external IR retainer before an incident occurs.
MITRE ATT&CK Mapping
Initial Access
Execution
Privilege Escalation
Credential Access
Lateral Movement
Collection
Command and Control
Exfiltration
Plain-Language Summary
Ransomware attackers typically spend about two weeks inside a network before locking files, during which they steal data and destroy backups. Organizations that handle this well are those who tested their backup restoration, named decision-makers in advance, and secured remote access with multi-factor authentication. Test a file restore from your newest backup this week, confirm all remote access requires MFA, and write three decision-maker names into your incident response plan.