What ransomware actually controls today

By the time ransomware encrypts your systems, the attacker may already hold administrative credentials, have impaired your backup infrastructure, have exfiltrated sensitive data, and have established extortion leverage independent of whether you can recover your systems. The encryption event that triggers incident response is the announcement that control has been established — not the moment it was lost.

The 2024 Change Healthcare attack illustrates this sequencing. According to UnitedHealth Group CEO Andrew Witty's May 2024 congressional testimony, attackers used compromised credentials to access the environment, moved laterally, and exfiltrated data before deploying ransomware. The encryption event was the final stage of an operation in which leverage had already been built (Source: Andrew Witty, congressional testimony, May 1, 2024, pp. 4–5, https://www.congress.gov/118/meeting/house/117242/witnesses/HHRG-118-IF02-Wstate-WittyS-20240501-U5.pdf).

Most organizations design ransomware defense around the encryption phase, when many control options have already narrowed. What changes outcomes: understanding what each stage of a ransomware operation establishes, and where defenders retain decision authority.

Ransomware as a system

Modern ransomware operates as a multi-stage operation, not a single malware event. Initial access brokers sell credentials and network footholds to affiliate operators, who deploy ransomware-as-a-service platforms for execution and payment processing. Roles and capabilities vary significantly across affiliates and groups — not every operation follows the same path or uses the same tools (Source: CISA, Understanding Ransomware Threat Actors: LockBit, https://www.cisa.gov/news-events/cybersecurity-advisories/aa23-165a).

It is also important to distinguish the types of control attackers accumulate across stages:

These are distinct. An attacker with data possession retains extortion leverage even if system recovery succeeds. An attacker with administrative privilege has not necessarily impaired every recovery option. These distinctions matter for how defenders assess their situation and options at each stage.

Mandiant M-Trends 2024 reports a global median dwell time — measured from compromise to detection — of 10 days across investigated intrusions. For ransomware cases specifically, the median was 5 days, reflecting the compressed timelines of many ransomware operations. These figures measure time to detection, not time to encryption, and describe investigated cases rather than all incidents (Source: Mandiant M-Trends 2024 Executive Edition, p. 2, https://services.google.com/fh/files/misc/m-trends-2024-executive-edition.pdf).

What practitioners need to recognize: each stage transfers additional leverage from defender to attacker. The encryption phase typically executes when the attacker has accumulated sufficient leverage to demand payment — not when they first achieve access.

A model of ransomware stages

The following describes a common operational pattern in ransomware intrusions. It is an illustrative model, not an inevitable sequence. Activities across stages frequently overlap, and some operations skip stages entirely. Some attackers conduct data theft and extortion without deploying encryption at all (Source: CISA, #StopRansomware Guide, https://www.cisa.gov/stopransomware/ransomware-guide). The stages are useful for understanding where attacker leverage accumulates and where defender options narrow — not as a precise playbook.

Initial Access establishes the first foothold through credential compromise, software exploitation, or supply chain insertion. The attacker gains authenticated access to internal systems, bypassing perimeter controls. At this stage, attacker capability is typically limited to the compromised account or system.

Lateral movement and privilege escalation expands access across the environment. Attackers enumerate Active Directory relationships, escalate toward domain-level privileges, and identify critical systems including backup infrastructure. This stage determines the potential scope of eventual encryption and impairment.

Data exfiltration creates a second pressure track. Sensitive data is staged and transmitted to attacker-controlled infrastructure, often before encryption begins. Once data has been exfiltrated, the attacker holds extortion leverage over data exposure regardless of whether system recovery succeeds.

Recovery impairment targets backup servers, cloud snapshots, and recovery processes to reduce the victim's ability to restore operations without engaging the attacker. The degree of impairment varies — independently protected or air-gapped backups may remain viable even when primary backup infrastructure is compromised.

Encryption execution triggers operational disruption. Systems are encrypted to force engagement, often after the attacker has positioned other leverage.

Post-encryption pressure escalates demands through data publication threats, media contact, and regulatory notification warnings. At this stage, the attacker exerts influence over the timeline of data exposure and can shape external communications — but victim organizations retain their own channels for legal response, regulatory notification, and customer communication.

Some operations combine stages differently, and extortion-only operations skip encryption entirely. The model should be read as a framework for assessing leverage accumulation, not a fixed sequence.

What each stage controls

Understanding what attackers establish at each stage reveals where defensive options narrow and where recovery plans are tested.

At initial access, defenders retain full technical response capability. By encryption execution, recovery depends heavily on controls and backup integrity established before the attack began. The critical operational insight: options to limit business impact exist primarily in the earliest stages, and some — particularly around data already exfiltrated — cannot be restored by technical recovery alone.

Where defenders lose options

Specific transitions narrow recovery choices most significantly.

Privilege escalation toward domain admin makes ordinary password rotation insufficient to contain the attacker. An adversary with administrative control over identity infrastructure can create new access paths, modify group policy, and maintain persistence through means that routine credential rotation will not address. Recovery requires coordinated remediation of identity infrastructure — a substantially more complex and resource-intensive process (Source: Microsoft, Advice for incident responders on recovery from systemic identity compromises, https://www.microsoft.com/security/blog/2020/12/21/advice-for-incident-responders-on-recovery-from-systemic-identity-compromises/). Containment remains possible, but it requires more than rotating individual passwords.

Backup infrastructure compromise reduces the viability of straightforward technical recovery. However, independently protected, air-gapped, or immutable backup copies may remain intact. The outcome depends on what was pre-positioned. Organizations without independently protected recovery copies face much harder choices; those with verified offline backups retain meaningful options even after primary backup systems are impaired (Source: CISA, #StopRansomware Guide).

Data exfiltration completion establishes extortion leverage that persists regardless of system recovery. Even if encryption is remediated and systems are restored, the attacker retains the ability to publish or sell exfiltrated data. Organizations need separate frameworks for assessing data exposure risk alongside system recovery — recovery from one does not resolve the other.

Organizations typically discover ransomware attacks through encryption alerts rather than earlier-stage indicators. By encryption execution, technical recovery depends on pre-positioned offline capabilities and verified backup integrity. Detection in the first two stages — when containment and coordinated credential remediation can still limit scope — changes the outcome significantly.

Evaluate your environment against specific questions: Can your monitoring detect lateral movement before privilege escalation completes? Can you verify backup system integrity and independence daily? Can you identify data staging and large outbound transfers before exfiltration completes? These capabilities determine whether discovery leads to containment or damage assessment.

The three questions that matter

Ransomware preparedness reduces to three diagnostic questions that map directly to preserving options.

Can we recover? This tests backup integrity, offline recovery capabilities, and dependency mapping — specifically whether you can restore critical services to operation, not just recover files. Recovery viability depends on controls positioned before compromise. The relevant test is whether you have verified restoration of critical services from independently protected backups, with known recovery time against known business dependencies.

Can we act fast enough to preserve recovery options? This addresses lateral movement detection, containment capability, and the speed and completeness of identity remediation. The window for technical containment narrows when attackers achieve administrative privilege or impair backup infrastructure. The relevant test is whether your containment process — including coordinated identity recovery, not just password rotation — can execute before those transitions occur.

Do we understand the pressure model? This addresses data sensitivity, exposure impact, and decision frameworks for negotiation. Organizations need clarity on whether encryption, data exposure, or both create the primary business risk — and whether recovery from one resolves or leaves open the other. The relevant test is whether your leadership and legal teams have a pre-established framework for negotiation decisions that doesn't depend on figuring it out under pressure.

Each question tests different capability areas, but they interact in real incidents. Fast containment preserves recovery options only if backups are known-good and independently protected. Pressure analysis guides decisions only if recovery capabilities are accurately understood.

The operational test: Walk through your last tabletop exercise and answer each question with specific timeframes, success criteria, and named dependencies. If any answer is "we'll figure it out during the incident," that gap existed before the attack began.

Sources