13 min read
A manufacturing company in Ohio lost eleven days of production in March 2022. Not to a supply chain disruption. Not to a labor shortage. To a ransomware attack that entered through a single phishing email opened by an accounts payable clerk at 9:14 AM on a Tuesday. By 9:47 AM, the encryption had propagated across the entire domain. File servers, ERP system, production scheduling, customer records — all of it locked behind a demand for $380,000 in Bitcoin. Their backups? Connected to the same network. Encrypted alongside everything else.
They paid. Most do.
66% of organizations were hit by ransomware in 2021-2022, according to Sophos’s State of Ransomware report. The average total cost of recovery — not the ransom itself, but the full operational damage — reached $1.4 million. And here’s the number that should keep every business owner awake: the average downtime from a ransomware attack is 22 days. Twenty-two days of no access to your systems, your data, your operations. For a small or mid-size business, that’s not an inconvenience. That’s a death sentence.
I’ve worked ransomware incidents from both sides — helping organizations build defenses before an attack and leading recovery after one. The gap between businesses that survive ransomware and businesses that don’t isn’t budget. It isn’t technology sophistication. It’s preparation. The companies that recover are the ones that made specific, deliberate decisions months or years before the attack ever happened. The ones that don’t recover are the ones that treated ransomware as somebody else’s problem.
This guide covers the full lifecycle: how ransomware actually works, how to prevent it from reaching your environment, how to detect it when prevention fails, how to respond when detection comes too late, and how to recover when everything’s gone sideways. No theory. No fluff. Just the operational reality of defending a business against the most consequential cyberthreat of the decade.
How Ransomware Actually Works — And Why It’s Gotten Worse
Understanding the mechanics matters because it changes how you defend. Ransomware in 2022 isn’t what it was in 2017. The WannaCry era of spray-and-pray mass campaigns has been replaced by something far more dangerous: human-operated ransomware. Criminal groups — REvil, Conti, LockBit, BlackCat — run sophisticated operations that look more like penetration testing firms than street-level hackers.
Here’s the typical kill chain for a modern ransomware attack:
1. Initial access. The attacker gets a foothold. Phishing email with a malicious attachment. Stolen credentials from a previous breach. An exploited vulnerability in an internet-facing system — a VPN appliance, a remote desktop gateway, an unpatched web server. This is the moment everything starts, and it’s usually the quietest part of the attack.
2. Persistence and reconnaissance. Once inside, the attacker doesn’t immediately encrypt. They establish persistence mechanisms — scheduled tasks, registry modifications, additional backdoors — so they can re-enter even if you discover and close the original access point. Then they map your network. They identify your domain controllers, your backup systems, your most critical data stores. This phase can last days or weeks.
3. Privilege escalation. The attacker moves from the initial compromised account to higher-privilege credentials. They’re hunting for domain admin access. Once they’ve it, they own your entire Active Directory environment. Every system, every account, every server — all accessible.
4. Data exfiltration. Before encrypting anything, modern ransomware operators steal your data. This is the double extortion model that’s become standard. Even if you restore from backups and never pay the ransom, they still hold your data hostage. Customer records, financial documents, intellectual property, employee information — all exfiltrated to attacker-controlled infrastructure. Pay up, or it gets published. Some groups have moved to triple extortion: encrypt, exfiltrate, then DDoS your infrastructure for good measure.
5. Deployment and encryption. The attacker disables your security tools, deletes shadow copies, targets your backup infrastructure, and deploys the ransomware payload across every system they can reach. This happens fast — often overnight or over a weekend when nobody’s watching. You arrive Monday morning to ransom notes on every screen.
That Ohio manufacturer? The attacker was inside their network for 16 days before deploying the ransomware. Sixteen days of reconnaissance, credential harvesting, and backup identification — completely undetected. By the time the encryption started, the attacker knew their environment better than their own IT team did.
Prevention: Building Walls That Actually Hold
Prevention isn’t about making your organization unhackable. That’s not a thing. Prevention is about eliminating the easy entry points and making your environment hard enough that attackers move on to softer targets. Most ransomware operators are running a numbers game — they’ll invest effort in high-value targets, but for the majority of SMBs, the goal is simply not being the lowest-hanging fruit.
Patch Management — The Boring Fix That Prevents Catastrophes
Unpatched vulnerabilities are the second most common ransomware entry point after phishing. The Kaseya attack exploited a zero-day, sure — but the vast majority of ransomware exploits target vulnerabilities with patches that have been available for months or years. The ProxyShell vulnerabilities in Microsoft Exchange were patched in April and May 2021, and they were still being used to deploy ransomware into 2022 because organizations hadn’t applied the updates.
A rigorous patch management discipline isn’t glamorous. It doesn’t make for exciting boardroom presentations. But it closes the door on a massive percentage of attack vectors. Critical patches within 48 hours. High-severity patches within a week. Everything else within 30 days. Automate where possible. If you’re running a foundational cybersecurity program, patch management should be near the top of your priority stack.
Email Security — Your Most Targeted Surface
Phishing remains the number one ransomware delivery mechanism. Period. Full stop. Every investment you make in email security pays dividends disproportionate to its cost.
The layered email defense:
- SPF, DKIM, and DMARC configured on your domain. Non-negotiable. This prevents attackers from spoofing your domain to target your employees and your partners
- Advanced email filtering beyond your provider’s defaults. Proofpoint, Mimecast, or Barracuda — these catch the sophisticated phishing attempts that Microsoft Defender and Google’s built-in filters miss
- Attachment sandboxing that detonates suspicious files in an isolated environment before they reach the inbox. Most business-grade email security platforms include this capability
- Link rewriting and time-of-click analysis that checks URLs not just when the email arrives but when the user clicks — catching delayed weaponization where a benign link is changed to malicious after delivery
Multi-Factor Authentication — Everywhere, No Exceptions
Stolen credentials are the other dominant entry point. And MFA neutralizes them. An attacker can have a valid username and password, but without the second factor, they can’t authenticate. This single control prevents a staggering percentage of account compromise.
But here’s where businesses get it wrong: they enable MFA on email and call it done. MFA needs to be on everything — VPN, remote desktop, cloud admin panels, backup management consoles, SaaS applications, financial systems. Anywhere a credential can be used to access your environment, MFA must be present. Hardware security keys for administrators. Authenticator apps for everyone else. SMS-based MFA is better than nothing, but it’s vulnerable to SIM swapping and should be your last resort, not your first choice.
Network Segmentation — Containing the Blast Radius
Here’s the thing about that Ohio manufacturer: even with the initial compromise, the damage didn’t have to be total. If their network had been segmented — production systems separated from corporate systems separated from backup infrastructure — the attacker’s lateral movement would have been constrained. Encrypting one segment is bad. Encrypting everything is existential.
At minimum, segment these zones:
- Corporate workstations and user systems
- Servers and critical business applications
- Backup infrastructure (this one is non-negotiable — backups must be on a separate network segment with restricted access)
- IoT devices and operational technology
- Guest and public Wi-Fi
Each segment should have firewall rules governing what traffic can flow between them. An infected workstation shouldn’t be able to directly communicate with your backup server. Ever.
Endpoint Detection and Response — Because Antivirus Isn’t Enough
Traditional antivirus relies on signature matching — it catches known malware. Modern ransomware uses custom builds, fileless techniques, living-off-the-land binaries, and polymorphic code that signature-based detection simply misses. EDR platforms like CrowdStrike, SentinelOne, or Microsoft Defender for Endpoint use behavioral analysis to detect suspicious activity patterns regardless of whether they match a known signature.
The Ohio manufacturer had antivirus. On every endpoint. Updated daily. It didn’t catch a thing because the attacker used legitimate Windows administration tools — PowerShell, WMI, PsExec — to move through the network. To a signature-based antivirus, those look like normal system administration. To an EDR platform trained on behavioral patterns, they look like exactly what they are: lateral movement.
Detection: Finding the Attacker Before They Pull the Trigger
Prevention reduces your attack surface. Detection catches what gets through. And the window between initial compromise and ransomware deployment — that 16-day gap in the Ohio case — is where detection saves you.
The Detection Tools That Matter
SIEM (Security Information and Event Management). Aggregates logs from across your environment and correlates events to identify threats. For SMBs, cloud-native solutions like Blumira or Microsoft Sentinel bring this capability within reach without requiring a dedicated security operations team.
NDR (Network Detection and Response). Monitors network traffic for anomalous patterns — unusual data transfers, connections to known malicious infrastructure, lateral movement between systems that don’t normally communicate. Darktrace and ExtraHop are leaders, though the price point can be steep for smaller organizations.
AI-powered threat detection. The volume of security telemetry in even a small network exceeds what human analysts can process. Machine learning models that baseline normal behavior and alert on deviations are increasingly the first line of detection. Businesses already exploring how AI transforms their operations should recognize that security is one of AI’s highest-value applications — an AI-augmented detection platform running on a 50-endpoint network provides coverage that would require multiple full-time analysts to replicate manually.
The Warning Signs You Can’t Ignore
Not every detection requires expensive tooling. Train your IT team — or your managed security provider — to investigate these indicators immediately:
- Unexpected account lockouts or password resets, especially for privileged accounts
- New or modified scheduled tasks on servers
- Unusual outbound data transfers, particularly large volumes to unfamiliar destinations — this is likely exfiltration
- Security tools being disabled or tampered with
- RDP or VPN connections from unusual locations or at unusual hours
- Group Policy modifications that weren’t authorized
Any of these in isolation could be benign. Multiple occurring together? That’s an active compromise, and you need to move immediately.
Response: The First 60 Minutes Determine Everything
You’ve detected ransomware activity — or worse, you’ve arrived to encrypted systems and ransom notes. The next 60 minutes are the most consequential of the entire incident. Every minute of delay is additional encryption, additional data exfiltration, and additional lateral movement.
The Immediate Response Checklist
Minutes 0-15: Contain.
- Isolate affected systems from the network. Disconnect Ethernet cables. Disable Wi-Fi adapters. If you can’t physically isolate, disable the switch ports. The goal is stopping propagation immediately
- Disable compromised accounts. If you know which credentials the attacker is using, disable them. If you don’t know, disable all administrative accounts except the one you’re using for response
- Block attacker infrastructure at the firewall and DNS level. If your security tools have identified command-and-control domains or IPs, block them network-wide
Minutes 15-30: Assess.
- Determine the scope. How many systems are affected? Is encryption still active or has it completed? Are your backups intact?
- Identify the ransomware variant. The ransom note usually names it. This matters because some variants have known decryptors, and the variant tells you which threat actor you’re dealing with and what their typical behavior pattern looks like
- Check backup integrity. Before you do anything else, verify that your offline and air-gapped backups are clean and accessible. If they are, your recovery path just got dramatically simpler
Minutes 30-60: Mobilize.
- Activate your incident response plan. Call your MSSP’s incident response team, your cyber insurance carrier’s breach hotline, your legal counsel, and your forensics provider
- Preserve evidence. Don’t reboot or wipe affected systems until forensic images have been captured. You need this evidence for the investigation, for your insurance claim, and potentially for law enforcement
- Begin communication. Your employees need to know what’s happening. Your customers may need to know. Your regulators may require notification within specific timeframes. Don’t wing this — follow the communication plan you built in advance
To Pay or Not to Pay
This is the question everyone asks and nobody wants to answer. Here’s the honest assessment:
Arguments for paying: Your business is dying every day you’re down. Your backups are gone. You’ve no other path to recovery. Some portion of ransom-paying organizations (about 61% according to Sophos data) do get their data back.
Arguments against paying: There’s no guarantee you’ll get a working decryptor. Even when you do, decryption is slow — restoring a large environment from decryption can take as long as restoring from backup. You’re funding criminal operations and painting a target on yourself for repeat attacks. 80% of organizations that paid a ransom were attacked again, according to Cybereason’s research.
The pragmatic answer: The decision to pay is a business decision, not a moral one. If your backups are intact, don’t pay. Restore and move on. If your backups are compromised and your business can’t survive the time required to rebuild from scratch, paying becomes a calculation of last resort — made in consultation with legal counsel, your insurance carrier, and ideally law enforcement.
The far better answer: never be in a position where paying is your only option. That’s what the backup strategy in the next section is about.
Recovery: The Architecture That Saves Your Business
Recovery isn’t something you figure out during an incident. It’s an architecture you build beforehand and maintain continuously. The businesses that recover from ransomware in days instead of weeks — or months — are the ones that invested in recovery infrastructure long before they needed it.
The 3-2-1-1 Backup Strategy
The classic 3-2-1 rule gets an upgrade for the ransomware era. You need:
- 3 copies of your data
- 2 different storage media types
- 1 copy offsite
- 1 copy air-gapped or immutable
That fourth element is what separates businesses that recover from businesses that pay. An air-gapped backup — physically disconnected from your network — can’t be encrypted by ransomware because the ransomware can’t reach it. An immutable backup — stored in a way that prevents modification or deletion for a defined retention period — achieves the same protection through technology rather than physical separation.
Practical implementation:
- Daily automated backups to your primary backup infrastructure (on-network)
- Daily replication to cloud-based backup storage with immutability enabled. Services like Wasabi, Backblaze B2, or the immutability features in Veeam and Datto prevent anyone — including an attacker with admin credentials — from deleting or modifying backups during the retention window
- Weekly offline backup to a physically disconnected drive that’s stored offsite. Yes, this is manual. Yes, it’s inconvenient. And yes, it’s the backup copy that will save your business when everything else has been encrypted
Test Your Restores. Then Test Them Again.
I can’t stress this enough. A backup that has never been tested isn’t a backup. It’s a hope. And hope isn’t a strategy — it’s a prayer.
Test full system restores quarterly. Not just file-level restores — full system rebuilds from backup. Measure your Recovery Time Objective (RTO): how long does it take to get a critical system operational from backup? Measure your Recovery Point Objective (RPO): how much data do you lose between the last backup and the incident? If your RTO is 72 hours and your business can only survive 24 hours of downtime, you’ve a gap that will kill you during an actual incident.
Document the restore process step by step. The person who built your backup system might not be the person who needs to execute the restore at 2 AM on a Sunday. The documentation should be detailed enough that anyone with basic IT competency can follow it.
The Recovery Sequence
When you’re executing a full recovery from ransomware, sequence matters:
1. Rebuild from known-clean infrastructure. Don’t try to clean infected systems. Wipe them and rebuild from scratch using known-good OS images and your backup data. The attacker may have left persistence mechanisms that survive a simple malware removal.
2. Restore Active Directory first. Everything in a Windows environment depends on AD. Get your domain controllers operational before anything else.
3. Restore critical business systems in priority order. What does your business need to generate revenue? Restore that first. Email, ERP, customer-facing systems, financial platforms — whatever drives your core operations.
4. Validate data integrity before going live. Restored data can be corrupted or incomplete. Verify critical databases, check file integrity, and confirm that applications function correctly before declaring recovery complete.
5. Monitor aggressively post-recovery. The attacker may still have credentials or access paths you haven’t identified. Increase monitoring sensitivity for 90 days after recovery. Watch for signs of re-compromise. Consider resetting every credential in the environment — painful but thorough.
Building Ransomware Resilience: The Quarterly Checklist
Ransomware defense isn’t a project with a completion date. It’s an ongoing operational discipline. Here’s the quarterly cadence that keeps your defenses current:
Every quarter:
- Run a tabletop exercise simulating a ransomware scenario. Walk through detection, containment, communication, and recovery with the actual people who would execute each step
- Test backup restores. Full system recovery for at least one critical system
- Review and update your incident response plan based on new threat intelligence and lessons from the tabletop
- Audit administrative access. Remove any unnecessary privileged accounts. Verify MFA is active on every one that remains
- Verify patch compliance. Identify and remediate any systems that have fallen behind on critical updates
- Review your supply chain security posture. Assess whether any vendor changes or new integrations have introduced exposure
Every year:
- Engage an external party for a security assessment or penetration test. Your own team has blind spots — an outsider will find what you’ve missed
- Review and renew your cyber insurance policy. Ensure coverage limits reflect your current risk profile and that policy exclusions don’t create gaps you’re unaware of
- Update your business impact analysis. As your business evolves, the systems and data that matter most will shift. Your recovery priorities should shift with them
The Real Talk
Ransomware isn’t going away. The economics are too favorable for the attackers — low risk, high reward, and a steady supply of organizations that haven’t done the work. Criminal groups are running professional operations with dedicated R&D teams, customer service desks for ransom negotiations, and affiliate programs that recruit new operators with a revenue share model. This is organized crime operating at scale, and it’s getting more sophisticated every quarter.
But here’s what I’ve learned from working both sides of this problem: the businesses that do the work — real patch management, real email security, real backup architecture, real incident response planning — overwhelmingly survive ransomware attempts. Not because their defenses are perfect. Because their defenses are layered, their detection catches what the prevention misses, and their recovery architecture means the attacker’s leverage disappears.
The businesses that get destroyed are the ones that knew the risk and decided it was somebody else’s problem. The ones that assumed their antivirus was enough. The ones that had backups but never tested them. The ones that had an incident response plan in a drawer that nobody had read since it was written.
Don’t be that business. The work isn’t glamorous, and it isn’t optional. Build the layers. Test the backups. Run the exercises. Because the attacker who’s going to target your organization isn’t waiting for you to get around to it.
