ransomware attack chains defence playbook

Ransomware Attack Chains and Defence Playbooks: A Technical Deep Dive

I investigated a ransomware incident last week that started as a simple phishing email and ended with an entire hospital network locked down. Ransomware continues to evolve, and understanding the full attack chain—from initial access to data exfiltration—is no longer optional for security teams. Here's what I've learned from my latest engagements.

Why This Matters Right Now

Ransomware groups have shifted their tactics. We're seeing more double-extortion and triple-extortion models where attackers don't just encrypt files—they steal data first, threaten public exposure, and pressure victims through DDoS attacks on their customer-facing services. The attack surface has expanded too: ransomware-as-a-service (RaaS) platforms like LockBit 3.0, BlackCat, and Cl0p have lowered the barrier to entry for less skilled threat actors.

The Modern Ransomware Attack Chain

Let me break down the typical chain I encounter in incident response engagements:

1. Initial Access — Phishing, RDP brute-force, compromised VPN credentials, or exploiting unpatched vulnerabilities (CVE-2023-23397 for Outlook, CVE-2022-30190 "Follina").
2. Execution — PowerShell or CMD execution, often using LOLBins (Living Off the Land Binaries) to evade AV.
3. Persistence — Scheduled tasks, registry Run keys, WMI event subscriptions.
4. Privilege Escalation — Token impersonation, exploitation of unquoted service paths, or credential dumping with Mimikatz.
5. Lateral Movement — PsExec, WMI, RDP, or SMB spreading across the network.
6. Defense Evasion — Process hollowing, AMSI bypass, disabling Windows Defender via Group Policy.
7. Impact — File encryption with RSA-2048 + AES-256, deletion of shadow copies, wiping backup files.
8. Exfiltration — Data staged in %TEMP% or C:\PerfLogs before exfiltration via HTTPS or cloud storage APIs.

Real-World Example: A Healthcare Ransomware Incident

Last month, I responded to a Cl0p ransomware incident at a mid-sized healthcare provider. The attack chain looked like this: an employee clicked a phishing link that downloaded a malicious CHM file. The CHM file executed a PowerShell payload that downloaded the Cl0p ransomware variant. The attacker had compromised an admin account via the phishing link's credential-harvesting page, giving them initial domain access.

Within four hours, the ransomware had encrypted over 3,000 files across 12 servers and exfiltrated 1.2TB of patient records. The attackers demanded $2.5 million in Monero.

Step-by-Step Technical Breakdown

Let me show you how I investigate these attacks. First, I check for suspicious scheduled tasks and persistence mechanisms:

# Check for suspicious scheduled tasks
schtasks /query /fo LIST /v | findstr /i "encrypt ransom lockbit clop"

# Check for malicious PowerShell execution
Get-WinEvent -LogName "Microsoft-Windows-PowerShell/Operational" -MaxEvents 1000 | Where-Object {$_.Message -match "encodedcommand|hidden|-enc"} | Format-Table TimeCreated, Message -AutoSize

# Check for credential dumping
eventvwr.msc /s /r /y "Security" | findstr /i "4624 4672"

Next, I look for lateral movement indicators and encryption artifacts:

# Check for SMB connections (lateral movement)
netstat -ano | findstr "445"
tasklist /v | findstr "exe"

# Find recently modified files (encryption activity)
forfiles /P C:\ /S /D +01/15/2024 | findstr "\.encrypted\|\.locked\|\.crypto"

Defence and Mitigation Strategies

Here's my defence playbook, based on what actually works in the field:

• Network Segmentation: Implement micro-segmentation to limit lateral movement. VLANs for clinical systems, admin workstations, and backups.
• EDR Deployment: CrowdStrike, SentinelOne, or Microsoft Defender for Endpoint with behavioural detection enabled.
• Backup Strategy: 3-2-1 rule. Air-gapped backups tested monthly. Immutable backups are non-negotiable.
• Patch Management: Prioritize CVEs in internet-facing services. Automate patching for VPNs and RDP endpoints.
• Phishing Resistance: Enable DMARC, SPF, and DKIM. Deploy email security gateways with sandboxing (Proofpoint, Mimecast).
• Identity Hardening: Enable MFA everywhere. Implement privileged access management (CyberArk, BeyondTrust).
• Monitoring: SIEM with correlation rules for ransomware indicators. Alert on mass file renames, shadow copy deletions, and suspicious PsExec usage.

Recommended Tools and Further Reading

Here are the tools I rely on:

• Mimikatz detection: Use Red Canary's Sigma rules or Atomic Red Team tests
• Network detection: Zeek (Bro) for protocol analysis, Wireshark for packet inspection
• Threat intelligence: MISP, Abuse.ch, and Flashpoint for IOCs
• Response automation: TheHive, Shuffle, or Velociraptor for IR automation
• Encryption analysis: Ransomware Identification Tool (RIT) from CrowdStrike

For deeper learning, I recommend:

• Ransomware: The Ultimate Guide by Steve Morgan
• Mitre ATT&CK framework — T1486 (Data Encrypted for Impact), T1560 (Archive Collected Data)
• The 2024 CISA Joint Ransomware Guide
• Ryan Jones' blog on Ransomware IR playbooks

Key Takeaways

Ransomware attack chains are predictable once you know what to look for. The key is defence-in-depth: assume breach, limit blast radius through segmentation, and have tested backup and recovery procedures. Detection must be faster than encryption—deploy EDR with behavioural analytics and monitor for the telltale signs like shadow copy deletion and mass file renaming.

The attackers are getting more sophisticated, but so can we. Build your playbook now, test it monthly, and share it with your SOC. The next incident is never a question of if—it's when.