Understanding how criminals start Ransomware attacks shows that the initial foothold often comes from a stolen password, a phished credential, or an exposed remote service, with encryption occurring much later. Between that first foothold and the ransom note, an attacker typically moves through your network for days or weeks, learning where your backups live and which accounts hold the keys. For a small or midsize business, that gap is the whole story. The phishing email gets the headlines, but the damage is decided in the silent stretch in the middle, when an intruder is already inside and no alarm has sounded. We have walked clients through this timeline after the fact, and the same pattern repeats: the door opened long before anyone noticed.
The 5 things every SMB should know before the first click
Read these five points first. They reframe ransomware from a single bad email into a chain you can break at several places.
- Initial access is rarely the moment of damage. The first foothold is usually a phished login or an exposed Remote Desktop Protocol (RDP) port. Encryption comes much later, after the attacker has explored.
- Dwell time is the real risk window. Attackers commonly sit inside a network for days to weeks before triggering encryption. That waiting period is also your detection opportunity.
- They hunt your backups first. Modern ransomware crews find and destroy or encrypt backups before locking your production data, which is what turns an incident into a crisis.
- Lateral movement depends on a flat network. If one compromised laptop can reach every server, the attacker wins fast. Segmentation slows that cold.
- Detection beats prevention alone. You cannot block every phish. You can catch the unusual behavior that follows one, if you are watching for it.
These principles apply whether you run a 40-person accounting firm or a 400-seat manufacturer. The tooling scales, the logic does not change.
How ransomware attacks start with initial access
Ransomware attacks start when an intruder gains a first valid way into your environment, and that entry point is almost always credential-based or service-based rather than a dramatic exploit. The Cybersecurity and Infrastructure Security Agency (CISA) documents this consistently in its ransomware guidance: phishing, stolen or guessed remote-access credentials, and unpatched internet-facing software lead the list of entry methods. We see the same three doors over and over in SMB incidents. None of them require the attacker to be sophisticated. They require the attacker to be patient and your perimeter to be slightly imperfect.
What makes this phase hard to catch is that nothing breaks. A successful phish produces a normal login. An RDP session opened with a valid password looks like a valid session. This is why the first hours of an intrusion pass without an alert in most small businesses. The opening move of the attack chain is designed to look like ordinary work.
How phishing creates the first foothold
Learning how criminals start ransomware attacks highlights phishing as the most common method, where an employee is tricked into providing valid credentials. The MITRE ATT&CK framework classifies this under Initial Access, and the technique is deliberately mundane: a fake login page, a spoofed vendor invoice, a request to re-authenticate. The argument in favor of treating phishing as the core problem is sound. Stop the phish and you stop most chains before they begin, which is what security awareness training is actually buying you.
The opposing view is just as important. Phishing is not a problem you fully solve, because it targets human judgment under time pressure, and even trained staff click eventually. Treating awareness training as the finish line leaves you exposed the day someone has a bad morning. Both sides hold. Training reduces volume, and it should be in place, but it cannot be the only layer. We recommend pairing it with phishing-resistant multi-factor authentication (MFA), so a stolen password alone does not unlock anything. Our guidance on preventing ransomware attacks treats the human layer and the technical layer as partners, not substitutes.
Why exposed remote access invites intruders
Recognizing how criminals start ransomware attacks includes understanding that unprotected remote access, such as open RDP or VPN ports, provides a constant opportunity for intruders. RDP, the Windows protocol that lets someone control a machine remotely, is convenient for a small IT team and equally convenient for an attacker who finds it facing the internet. One camp argues that remote access is simply a necessity for distributed teams and that locking it down too hard slows the business. There is truth there. People need to work from home, and friction has a cost.
The counterposition is that unguarded remote access is one of the fastest-growing initial-access routes precisely because it is so often left open with weak credentials. The honest middle ground is not to remove remote access but to gate it. Put RDP behind a VPN or a zero-trust broker, enforce MFA on every remote session, and never expose the raw port. We have responded to incidents where a single internet-facing RDP server with a reused admin password was the entire entry story.
How unpatched software opens the door
One way to see how criminals start ransomware attacks is through unpatched software, where vulnerabilities in internet-facing systems allow attackers to enter without needing stolen credentials. This is the vector that needs no employee mistake. A public-facing firewall, file-transfer appliance, or web application running an outdated version gives an attacker a documented path inside. Some teams argue that aggressive patching risks breaking production systems, and in fragile environments that concern is real. Downtime from a bad patch is a genuine cost.
The other side weighs heavier for most SMBs. The window between a vulnerability becoming public and attackers scanning for it is now measured in days. Waiting a full quarter to patch internet-facing systems is the larger gamble. We hold both concerns by separating tiers: patch internet-facing and high-risk systems on a tight cycle with a tested rollback plan, and patch internal low-risk systems on a calmer schedule. The point is to shrink the exposed surface, not to break the business doing it.
What happens after the breach but before encryption
Examining how criminals start ransomware attacks reveals that after initial access, attackers spend days in the network performing reconnaissance and lateral movement, which determines the ultimate impact. This is the part the top search results tend to skip. They list the entry vectors well, then jump to the ransom note. The reality for an SMB is that an intruder who got in on Monday may not encrypt anything until the following week, and that delay is the most useful fact in this entire article. It means there is time to catch them, if someone or something is watching the right signals.
Dwell time, the span between initial compromise and the attacker’s final action, is your defensive window. The attacker uses it to map your network, steal more credentials, locate your domain controllers, and find your backups. You can use the same window to detect anomalies: a service account logging in at 3 a.m., a workstation suddenly scanning internal IP ranges, a sudden spike in failed authentications. Our team treats this middle phase as the primary place to break the chain, which is why we lean on monitoring as heavily as we lean on prevention. Reframing defense around this gap is the core argument of our resource on ransomware attacks.
How attackers move laterally across a flat network
Attackers move laterally across a flat network by reusing harvested credentials to hop from the first compromised machine to higher-value systems, and a network with no internal boundaries makes this trivial. Once inside one laptop, the intruder looks for cached credentials, mapped drives, and reachable servers. In a flat network, where every device can talk to every other device, a single foothold becomes domain-wide access in hours.
There is a counterargument that heavy segmentation adds operational complexity and can frustrate legitimate workflows, and for very small teams that overhead is a fair worry. Segmentation done badly creates help-desk tickets. The stronger position, supported by Microsoft’s zero-trust network guidance, is that even basic segmentation, separating servers from workstations, isolating backups, restricting administrative protocols, dramatically slows lateral movement. You do not need a perfect microsegmentation deployment on day one. You need to ensure that one infected endpoint cannot reach your entire environment.
Why attackers target backups before they strike
Attackers target backups before they strike because functional backups are the one thing that lets you refuse the ransom, so destroying them is how they guarantee leverage. Modern ransomware operators specifically hunt for backup servers, cloud backup credentials, and snapshot systems during the dwell period. If they can encrypt or delete your recovery copies, the only path to your data runs through their payment portal, which is the whole argument for keeping one copy air-gapped.
Some argue that strong backups alone are a sufficient ransomware strategy, and backups are genuinely your most important recovery control. The flaw in relying on them alone is that an attacker with the dwell time we described will find online, writable backups and neutralize them first. The resolution is the well-known 3-2-1 approach with an immutable or offline copy: backups the attacker cannot reach or alter even with domain admin rights. We walk through this recovery posture in detail in our breakdown of lessons from recent breaches.
How early detection breaks the attack chain
Early detection breaks the attack chain by surfacing the attacker’s quiet activity during dwell time, before they reach the encryption step. The tool category here is Endpoint Detection and Response (EDR), software that watches process behavior on every device and flags the patterns that precede ransomware: credential dumping, mass file enumeration, the disabling of security tools. EDR shifts the question from “did we block the phish” to “did we notice what the phish led to.”
The skeptical view is that detection tooling is expensive, generates noise, and demands someone to watch it, which is a real constraint for a lean SMB with no dedicated security staff. That concern is legitimate, and unmonitored EDR is close to useless. The honest answer is that detection only works as a managed function, with alerts triaged by people who know what normal looks like for your environment. That is precisely the gap a managed provider fills. Our network protection guidance frames detection and response as a service, not a product you buy and forget.
How SMBs build defense around the full chain
SMBs build defense around the full chain by placing a control at each phase, initial access, dwell, and impact, rather than betting everything on stopping the first email. The companies that recover well from ransomware are not the ones with a perfect perimeter. They are the ones who assumed a breach would eventually happen and built layers to catch and contain it. The National Institute of Standards and Technology lays out this phased thinking in its incident handling guide, which treats detection and containment as equal partners to prevention.
In practice, that means MFA and patching to shrink the entry surface, segmentation and least-privilege access to slow lateral movement, immutable backups to remove the attacker’s leverage, and monitored EDR to catch the quiet middle. No single one of these is enough. Together they turn a fast, quiet, catastrophic event into a slow, noisy, survivable one. When a client engages our ransomware response team, the first thing we assess is which of these layers were missing, because the gap is almost always in the middle of the chain, not at the front door.
Frequently Asked Questions
How do most ransomware attacks start?
Most ransomware attacks start with phishing, stolen remote-access credentials, or an unpatched internet-facing system. These three vectors account for the large majority of SMB incidents. The common thread is that the first step looks like normal activity, which is why it so often goes unnoticed.
How long do attackers stay in a network before encrypting?
Attackers commonly stay in a network for several days to multiple weeks before triggering encryption. They use this dwell time to map the environment, steal more credentials, and locate backups. This waiting period is also the best window to detect and stop them before any data is locked.
Can antivirus alone stop a ransomware attack?
Traditional antivirus alone cannot reliably stop a modern ransomware attack, because it focuses on known malicious files rather than attacker behavior. Ransomware crews increasingly use legitimate tools and stolen credentials that antivirus does not flag. Endpoint Detection and Response, which watches behavior across the chain, is the stronger control.
Why do attackers go after backups first?
Attackers go after backups first because working backups let you recover without paying the ransom. By encrypting or deleting your recovery copies during the dwell period, they remove your alternative and force the payment decision. An offline or immutable backup copy defeats this tactic.
What is the single most effective control for an SMB?
There is no single control that is sufficient on its own, but phishing-resistant MFA delivers the most protection for the least effort. It stops the most common entry vector, stolen credentials, from working even when a password leaks. Pair it with monitored detection and immutable backups for real coverage.
Talk through your ransomware exposure with our team
Ransomware attacks start quietly and end loudly, and the distance between those two moments is where a prepared business survives and an unprepared one does not. The chain is breakable at the entry point, during the dwell period, and at the moment of impact, but only if you have placed a control at each stage and someone is watching the middle. Most of the SMBs we work with had reasonable intentions and a real gap somewhere along that chain, usually in detection or backup isolation, and they did not know it until an incident exposed it. You do not have to wait for that. If you want a clear read on where your own defenses break the chain and where they would let it run, book a free strategy call with our team and we will walk the full timeline with you, from first access to recovery.
Ransomware Attack Chain Analysis and Cybersecurity Defense Expertise from Matt Rosenthal
Matt Rosenthal, CEO of Mindcore Technologies, has over 30 years of experience helping SMBs understand and defend against the full ransomware attack chain, from credential theft and exposed remote access through lateral movement, backup destruction, and encryption. He has seen firsthand how businesses with reasonable perimeter controls still suffer catastrophic ransomware events because nobody was monitoring the dwell period where the outcome is actually decided. Matt leads a team that builds layered defenses across every phase of the attack chain, combining phishing-resistant MFA, network segmentation, immutable backups, and managed endpoint detection so that a breach attempt becomes a noisy, containable event rather than a silent, business-ending one.
