From Phishing to Ransom: Anatomy of a Modern Ransomware Attack

At 2:37 AM, hundreds of computers lock up at once. A ransom note fills every screen.

The attack didn't start then. Days earlier, someone clicked a link in an email titled "Urgent: Your Microsoft 365 account will be disabled today." The page looked right. They typed their password. Nothing seemed to happen.

That's the real story of modern ransomware: an attack chain, not a single piece of malware.

The chain

Stage What the attacker does

1. Initial access Phishing, stolen credentials, unpatched VPN, exposed remote service, or a compromised vendor
2. Discovery Maps users, servers, file shares, and backups
3. Privilege escalation Hunts for admin-level accounts
4. Lateral movement Hops from machine to machine
5. Data theft Copies sensitive files out
6. Encryption Locks systems, often hitting backups first
7. Extortion "Pay, or we leak it"

Encryption is the final visible stage. By then, the attacker has usually been inside for a while.

Phishing works because it targets people, not machines

Attackers don't need to hack your computer if they can get you to help them. They lean on urgency, fear, and authority:

"Your account will be permanently deleted in 30 minutes."

That message isn't meant to inform you. It's meant to make you act before you think.

It comes in many forms: fake login pages, spear phishing that mentions your name and colleagues, SMS "KYC" scams, fake IT-support calls, and QR codes that lead to malicious sites.

But phishing isn't the only door

According to Verizon's 2025 Data Breach Investigations Report, the top known entry points were:

Initial access Share of breaches Credential abuse22%Vulnerability exploitation20%Phishing16%

So a strong email filter alone won't save you. Attackers also walk in through VPN appliances, exposed remote desktop services, reused passwords, info stealer malware, and vendors you already trust.

Two kinds of ransomware

• Worm-like: spreads on its own through vulnerable machines. WannaCry (2017) hit systems worldwide, including the UK's NHS, using a flaw Microsoft had already patched.
• Human-operated: the more common model today. Real people spend days inside your network, stealing credentials, disabling defenses, and finding your most critical servers before they deploy anything.

Double extortion: why backups aren't the whole answer

Modern groups don't just encrypt. They steal first, then threaten to publish. Some skip encryption entirely.

Backups get you back online. They can't un-steal your data.

Real attacks, one lesson each

• WannaCry (2017): An unpatched vulnerability can become a network-wide problem.
• NotPetya (2017): It looked like ransomware but behaved like a wiper. Not every attack is about the ransom.
• Colonial Pipeline (2021): Senate testimony described a compromised VPN credential on a legacy account with no MFA. One remote-access account can shut down critical infrastructure.
• MGM Resorts (2023): Social engineering and identity compromise can beat expensive perimeters.
• Change Healthcare (2024): One centralized provider going down disrupted healthcare across an entire sector.

Should you pay?

Don't make payment your recovery plan.

• CISA warns that paying doesn't guarantee you'll get your data back.
• The decryptor may be slow, broken, or never delivered.
• The attacker may still be inside your network.
• Stolen data stays stolen.
• Payment funds the next attack.
• Depending on who's behind it, sanctions and legal exposure may apply.

If a payment decision truly has to be made, it should involve incident-response specialists, legal counsel, insurers, and authorities. It shouldn't be made in panic from a ransom note.

If you're hit: first moves

1. Isolate affected machines from the network.
2. Protect what's still clean, especially backups and critical servers.
3. Preserve evidence. Don't wipe everything immediately.
4. Call in your security team, legal, insurer, and relevant authorities.
5. Reset credentials carefully, privileged accounts first.
6. Find how they got in, or the next attack will use the same door.
7. Restore from verified-clean backups. A backup you've never restored is an assumption, not a plan.

What actually reduces risk

Identity: MFA everywhere, phishing-resistant where possible (email, VPN, admin access). Least privilege. Separate admin accounts.

Patching: Prioritize anything internet-facing: VPNs, firewalls, remote access, email servers.

Segmentation: So one compromised laptop doesn't become the whole company.

Backups (3–2–1): Three copies, two storage types, one offline or isolated. Then test the restore.

Detection: Watch for odd logins, sudden mass file changes, unexpected admin activity, disabled security tools, and unusual outbound data transfers.

People: Before clicking, ask: Was I expecting this? Who really sent it? Where does the link go? Why the rush? When in doubt, open the official site yourself.

The mindset shift

Stop asking "How do I stop ransomware?" Ask:

• How could they get in?
• How would we notice?
• How do we stop them from moving?
• How fast can we recover?

Assume prevention will sometimes fail, and build so that failure is survivable.

Security isn't about a world where attackers never get in. It's about making sure that when something goes wrong, it doesn't become everything.

Sources: CISA Stop Ransomware Guide; Verizon 2025 DBIR; UK NCSC and UK Government on WannaCry; U.S. Senate Colonial Pipeline testimony; HHS on Change Healthcare.