Bottom line
Ransomware is run as a production line, and the encryption event is the last step of it. Access is handed between specialist groups in seconds, recovery systems are attacked before files are encrypted, and data is usually taken first. A defense built around stopping the encryptor arrives late. The time to act is on the earlier, quieter steps.
Key judgments
| Judgment | Confidence and basis |
|---|---|
| Initial access and encryption are often done by different groups, with little delay between them. Mandiant measured the median time from initial access to hand-off to a secondary group at 22 seconds, down from more than eight hours. Prior compromise was the most common vector in ransomware cases, at 30 percent. | High. Primary investigation data from a large caseload. |
| Edge exploitation and stolen credentials lead the way in. Verizon found 31 percent of breaches began with exploitation of a vulnerability, ahead of stolen passwords. In the Akira advisory, access came through SonicWall SSL-VPN weaknesses, compromised VPN credentials, password spraying and unpatched Veeam servers. | Moderate to high. Datasets differ in sample and method. The direction is consistent. |
| Operators go after recovery before encryption. Mandiant reports attacks on identity services, virtualization management planes and backup infrastructure, including deletion of backup objects and encryption of hypervisor datastores. | High. Reported by Mandiant and echoed in joint government advisories. |
| Theft precedes encryption, and the victim often learns from the attacker. In Mandiant’s ransomware cases the adversary notified the victim 44 percent of the time, internal teams found it 41 percent and an outside party 15 percent. | Moderate to high. Measured, but dependent on which cases reach responders. |
| Payment is weakening, but recovery stays expensive. In Sophos’s survey, 48 percent of victims with encrypted data paid, the median payment fell to $769,000 from $1 million, and average recovery cost reached $1.7 million. | Moderate. Self-reported survey data. |
The operating pattern, stage by stage
| Stage | Observed behavior | Evidence | Control point |
|---|---|---|---|
| Access | Exploited edge devices and VPNs, compromised or sprayed credentials, drive-by downloads from hacked legitimate sites, fake browser updates and fake CAPTCHA pages that make the user paste a command. | Akira and Interlock advisories. Verizon on exploitation. | Edge patching, VPN hardening and MFA, web filtering, user prompts for paste-and-run lures. |
| Hand-off and staging | Footholds are pre-staged with malware, tunnels or backdoors and passed to a follow-on group rather than sold on open markets. | Mandiant on hand-off time. | Treat low-severity alerts as possible precursors. Triage in minutes. |
| Credentials and domain | Credential stealers and keyloggers, then escalation to domain administrator, possibly through Kerberoasting. | CISA on Interlock. | Protect and monitor domain admin paths. Alert on new privileged accounts. |
| Discovery and movement | PowerShell reconnaissance, RDP and PsExec. Legitimate remote tools such as AnyDesk and ScreenConnect used for access and persistence. | CISA on Interlock. | Allowlist remote-access tools. Alert on unapproved installs. |
| Recovery denial | Backup objects deleted or unlinked from virtualization, local recovery points encrypted, Active Directory databases extracted by cloning virtual disks without touching the guest operating system. | Mandiant. Qilin affiliates targeting Veeam. | Isolate backup and hypervisor management. Immutable copies. Alert on backup changes. |
| Exfiltration | Bulk upload to cloud storage using tools such as AzCopy and WinSCP before encryption. | CISA on Interlock. | Egress monitoring. Alerts on large uploads to unapproved storage. |
| Encryption and notice | Windows, Linux and virtual machine payloads. Hypervisor datastores encrypted so every guest on a host is lost at once. Ransom notes pushed by Group Policy. Akira extended to Nutanix AHV after VMware ESXi and Hyper-V. | Mandiant. CISA on Interlock and Akira. | Segmentation of hypervisor management. Monitoring of Group Policy changes. |
Analysis
The hand-off changes what a small alert means. If a foothold can be passed to a second group in seconds, an infostealer detection or an unexpected remote-access tool is no longer a minor event to clean up on the next shift. Mandiant states the implication directly: treat low-impact alerts as critical indicators. Most SOC queues are not triaged on that assumption.
Hypervisors and backups are where leverage sits. Encrypting a hypervisor datastore removes every virtual machine on the host in one action, and cloning virtual disks to extract Active Directory happens beneath the guest operating system, where endpoint agents do not run. Akira moving to Nutanix AHV shows operators following the platforms organizations migrate to. Security teams that deploy EDR on servers and consider the job done have not covered the layer under them.
Theft changes the decision, not only the recovery. Because data leaves before encryption, restoring from backup solves the availability problem and leaves the disclosure problem untouched. Interlock, as CISA describes it, has followed through on threats to publish stolen data. Negotiation, regulator notification and customer communication all follow from what was taken, which is why exfiltration detection and log retention matter as much as backups.
The economics are shifting but the exposure is not. Sophos reports more victims recovering from backups and median payments falling. Verizon found ransomware in 48 percent of the breaches it analyzed and noted that payouts are shrinking. Lower payments do not reduce the outage, the recovery bill or the disclosure obligations. They may push operators toward more data theft and more pressure on recovery systems, but that is our interpretation, not a finding in these sources.
What should change
-
Triage precursor alerts as ransomware incidents in waiting. Infostealer hits, new remote-access tools and unexpected tunnels get minutes, not a queue position.
-
Treat identity, hypervisor management and backup systems as the highest tier. Mandiant recommends isolating tier-0 assets, using immutable backups and keeping a clean recovery environment.
-
Patch and harden the edge first. CISA directs organizations to prioritize known exploited vulnerabilities on internet-facing systems, and the Akira advisory names VPNs and backup servers specifically.
-
Watch for exfiltration as well as encryption. Large uploads to cloud storage, new bulk-transfer tools and unusual outbound volume are earlier signals than a ransom note.
-
Control remote-access tools. Allowlist the ones you use and alert on the rest.
-
Test recovery against a realistic adversary. The useful question is whether your backups survive an attacker who holds domain admin and hypervisor access, and in what order identity and core services would return.
-
Decide in advance who decides. Payment position, notification authority and external counsel should be agreed before an incident, not during one.
Gaps and limits
Akira and Interlock are two operations. They illustrate patterns and do not describe every group. Verizon, Mandiant and Sophos use different samples and methods, so their percentages are not comparable line by line. Sophos figures come from a survey of organizations, and Mandiant’s come from cases that reached responders. None of the sources measures how often secondary hand-offs lead to encryption, as opposed to other outcomes.
Next step
A practical check is to walk the stage table against your own environment and mark each stage where you would currently have no detection and no containment option.
Sources
-
Google Cloud, Mandiant: M-Trends cloud.google.com
-
Verizon: Data Breach Investigations Report verizon.com
-
Sophos: The State of Ransomware sophos.com
-
CISA and partners: #StopRansomware Interlock advisory cisa.gov
-
The Register: CISA flags imminent threat as Akira ransomware starts hitting Nutanix AHV (reporting the CISA and FBI advisory update) theregister.com
-
Google Cloud: Cloud Threat Horizons Report cloud.google.com
How we label evidence
Facts carry a source. Analysis and recommendations are marked as ours. Examples that are hypothetical are labeled as hypothetical.
Part of the solutionDetect, Respond & RecoverSpot attacks early and get back to business fast.See how we work →Related service
Ransomware Response
Use this to improve ransomware preparation and containment.