Three years ago the worst case looked simple: files encrypted, a note on the screen, a demand in cryptocurrency. That model still exists, but it is no longer where most of the damage lands. Attackers steal first, encrypt later, and sometimes skip encryption entirely. They read your financial statements before they set a price. They call your customers before you have finished your first incident bridge.

If your incident response plan begins and ends with "restore from backup," it covers only part of the problem. What follows is a practical look at how extortion works now, where the pressure lands, and the steps that genuinely reduce the odds and the cost.

Encryption Is Often the Last Move, Not the First

The intrusion usually runs quietly for a while before anyone outside the company hears about it. Credentials are abused, systems are mapped, data is staged and copied out. Only then does the crew decide whether to encrypt, and increasingly the answer is no. Why trigger backup restores, loud alerts and a full incident response when a silent copy of the finance share might never be noticed?

That shift changes what you need to detect. Ransomware detection historically focused on mass file modification. Today the more valuable signals are quieter: an ordinary user account reading far more data than usual, a service account authenticating from a new location, a large outbound transfer to a cloud storage provider nobody in the company uses.

Assume the data is already gone. Build your response around that assumption, not only around scrambled files.

It also means legal, communications and customer-facing readiness matter as much as recovery speed. A leak deadline does not pause while you rebuild servers.

Where the Attacks Are Landing Now

Target selection has moved down and sideways. Very large enterprises have mature detection, dedicated response teams and hard-to-navigate payment decisions. Smaller organisations pay faster and recover slower, and their suppliers are often the way in.

• Mid-sized firms with real revenue and a two-person security function. Enough money to pay, not enough staff to notice quickly.
• Managed service providers and IT outsourcers. One foothold becomes many victims, which is exactly the leverage attackers want.
• Identity and SaaS estates. Mail, file storage, ERP, ticketing and code repositories hold the data that regulators and customers care about.
• Virtualisation and backup infrastructure. Hypervisors and backup catalogues are targeted first because destroying them stretches recovery from days to weeks.
• Edge and network devices. VPN concentrators, firewalls, file transfer appliances and remote management agents.
• Operational technology, in smaller numbers but with disproportionate impact when production stops and cannot be restarted on a laptop.

Extortion Is a Campaign, Not a Single Threat

Pressure on the company

Leak sites, countdown clocks and drip-fed samples are the opening act. Crews also file complaints with data protection authorities, email journalists, and contact the customers whose records they hold. Each of these converts a technical incident into a regulatory and reputational one, which is precisely the intent.

Pressure on people

Calls to executives, messages to employees, and contact attempts at home addresses are used to overwhelm a small response team. The goal is to make the company want the problem to stop more than it wants to think clearly.

Pressure on the clock

Deadlines are typically set over weekends and public holidays, when staffing is thin and approvals are hard to obtain. If your escalation path depends on one person being reachable, it is not an escalation path.

One more thing worth stating plainly: data sold to another criminal group is still data that leaked. Silence on a leak site proves nothing.

The Ways In Are Boringly Familiar

• Stolen credentials and session cookies, harvested through convincing login pages that capture the authentication token and walk straight past multi-factor prompts.
• Unpatched internet-facing appliances, especially VPNs, firewalls and file transfer products that were installed years ago and forgotten.
• Remote monitoring and management tools left installed after a project ended, with shared credentials and no owner.
• Help desk manipulation: an attacker who knows enough about an employee can talk a service desk into resetting a password or enrolling a new device.
• Vendor and partner access that nobody reviews or revokes.
• Push-notification fatigue: repeated prompts until an exhausted user approves one.

The common thread is legitimate access. Tooling tuned only for malware will not see an attacker logging in with valid credentials from a country your company does not operate in.

Faster, Quieter, More Distributed

The affiliate model has fragmented into many small crews. Specialists sell access, others run negotiation, others host infrastructure, and the brand on the leak site may be nothing more than a shared template. That makes takedowns less decisive and attribution less useful to a defender under pressure.

Once access is established, impact arrives quickly, and it is often achieved with built-in administration tools, remote management software and cloud APIs rather than custom malware. Exfiltration rides out through ordinary business services, blending with normal traffic. Attacks frequently begin late on a Friday or during a holiday period, when the first responder on call is also covering three other things.

Controls That Change the Outcome

1. Phishing-resistant MFA for administrators and short session lifetimes. Hardware security keys where possible, number matching at minimum, and the ability to revoke every active session within minutes.
2. Separate admin identities and admin workstations. Nobody reads email or browses the web from an account that can change firewall rules.
3. Immutable, isolated backups, with rehearsed restores and a stated time target. Restoring files is easy to test and proves little. Restore a domain controller and a critical application instead.
4. Egress visibility. Log DNS, proxy and cloud storage activity, and alert on large or unusual outbound transfers rather than only inbound threats.
5. Attack surface inventory. List every internet-facing system, patch the ones you keep, and decommission the ones you no longer need.
6. Segmentation. A foothold in the office network should not reach the backup catalogue, the hypervisor console or the finance database.
7. Pre-arranged response. A retained incident response firm, legal counsel, a crisis communications contact and pre-delegated authority to act. Decisions made at 2 a.m. during an intrusion are reliably worse than decisions made in advance.
8. A written payment position, reviewed with counsel. Whether to pay is a legal and ethical question with sanctions implications, and it is far better answered before you are staring at a countdown clock. Get qualified legal advice; this is not a decision for a technical team alone.

The First Five Moves This Quarter

If the list above feels long, start here. These five actions take weeks, not years, and each one removes leverage from an attacker.

1. List every account with administrative rights to your identity platform, backups and hypervisors. Remove the ones nobody can justify.
2. Confirm you would actually see a large overnight data transfer. Pull a week of egress logs and look for yourself.
3. Pick one critical system and restore it from backup on a stopwatch. Write down the real number.
4. Remove unused remote access tools and stale vendor accounts, starting with the ones created during a project that ended in the last two years.
5. Draft the first twenty-four hours of communications: who calls whom, what you can say before you fully understand the situation, and who is allowed to speak publicly.

None of this is dramatic, and none of it is expensive relative to a week of downtime. The teams that come through a ransomware incident with the least damage are rarely the ones with the most tools. They are the ones who knew what they had, could see what was leaving, and had practised the recovery long before anyone demanded it.

Photo: Dan Nelson / Pexels