Overview — in brief
1) Initial access: Attackers gain entry through phishing, exposed RDP, or vulnerable appliances.
2) Reconnaissance: They enumerate domain assets, privileges, and backup locations.
3) Credential access: Tools are used to harvest or brute-force credentials for lateral movement.
4) Privilege escalation: The adversary obtains higher privileges to access sensitive systems.
5) Lateral movement: Compromise spreads across the network to reach high-value targets.
6) Data exfiltration: Sensitive files are staged and often exfiltrated for double extortion.
7) Ransomware deployment: Encryption binaries are deployed and executed en masse.
8) Ransom note & comms: Attackers leave ransom notes and sometimes publish stolen data.
9) Extortion & negotiation: Attackers demand payment; some victims negotiate or engage specialists.
10) Recovery & lessons learned: Post-incident activities focus on clean-up, recovery, and prevention.
Points explained
- Initial access: Phishing emails with malicious attachments or credential theft via exposed remote services are the most common vectors. Attackers often test different entry paths to find the weakest link.
- Reconnaissance: After access, attackers map the environment — identifying domain controllers, backup servers, and privileged accounts to plan a targeted strike.
- Credential access: Use of credential dumping tools or password spraying provides the attacker with broader reach; monitoring for unusual authentication is essential.
- Privilege escalation: Vulnerabilities or misconfigurations are exploited to elevate rights; protecting and monitoring admin accounts reduces the blast radius.
- Lateral movement: RDP, PsExec, WMI, and remote scheduled tasks are common techniques; microsegmentation and log-based detection help interrupt lateral activity.
- Data exfiltration: Sensitive datasets are gathered and staged; network egress monitoring, DLP, and anomaly detection can spot large transfers.
- Ransomware deployment: Attackers often disable backups, delete shadow copies, and run encryption in parallel; immutable backups and air-gapped copies are defense-in-depth measures.
- Ransom note & comms: At the point of impact, attackers provide instructions and payment channels — rapid legal and communications coordination is vital.
- Extortion & negotiation: Engaging incident response, legal counsel, and insurers early is recommended; paying ransoms has trade-offs and doesn’t guarantee full recovery.
- Recovery & lessons learned: Post-incident root cause analysis, improved monitoring, and tabletop exercises help prevent future occurrences.
Immediate containment steps
- Isolate affected hosts from the network and preserve volatile evidence for analysis.
- Collect logs (SIEM/endpoint) and snapshots of impacted systems to reconstruct the timeline.
- Block known C2 domains, reset compromised credentials, and increase monitoring on critical assets.