Ransomware Anatomy: How Modern Attacks Work End to End

In May 2025, the Black Basta group compromised a regional hospital network by phishing a single help desk account — and encrypted 4,000 endpoints within 11 hours. The speed wasn’t luck. It was a rehearsed playbook. Understanding that playbook, stage by stage, is how you stop the next one before hour three.

Stage 1: Initial Access and Persistence

Most modern ransomware groups don’t write exploits. They buy access. A phishing email drops a loader — often Qakbot or Latrodectus — which pulls down a Cobalt Strike beacon or Sliver implant. The malware phones home fast and establishes persistence before anyone notices the user clicked something wrong.

On the compromised workstation of jharris at CORP-WS-114 (192.0.2.44), Autoruns would show this registry key added within minutes of execution:

HKCU\Software\Microsoft\Windows\CurrentVersion\Run
Value: SvcHostHelper
Data: C:\Users\jharris\AppData\Roaming\svchost32.exe

File hash (SHA-256):
4a7d1ed414474e4033ac29ccb8653d9b
a3f2c1e05b88d4a9f6c7e2091d3b8847

That svchost32.exe name is a classic masquerade — legitimate Windows binaries live in System32, never in a user’s AppData. The hash won’t match anything Microsoft signed. A defender who catches this entry pulls the binary, submits it to a sandbox, and immediately isolates the host. An attacker who isn’t caught moves on within minutes to reconnaissance.

Stage 2: Lateral Movement and Credential Harvesting

Once the beacon is stable, the operator runs BloodHound (a tool that maps Active Directory attack paths) to find the fastest route to a Domain Admin account. Meanwhile, they dump credentials from LSASS — the Windows process that holds authentication secrets in memory.

A Mimikatz-style dump on CORP-WS-114 returns output like this:

Authentication Id : 0 ; 472831 (00000000:000737ff)
Session           : Interactive from 2
UserName          : jharris
Domain            : CORP
Logon Server      : CORP-DC-01
Logon Time        : 2026-07-20 08:14:22
SID               : S-1-5-21-3104709218-...

        msv :
         [00000003] Primary
         * Username : jharris
         * Domain   : CORP
         * NTLM     : aad3b435b51404eeaad3b435b51404ee
         * SHA1     : da39a3ee5e6b4b0d3255bfef95601890afd80709

        kerberos :
         * Username : jharris
         * Password : (null)
         * Domain   : CORP.LOCAL

That NTLM hash is all an attacker needs. They don’t crack it — they pass it directly using Pass-the-Hash to authenticate as jharris on other machines. From there, they pivot to CORP-FS-02 (192.0.2.87), the file server, and CORP-DC-01 (192.0.2.10), the domain controller. A defender reviewing Windows Event ID 4624 logs with Logon Type 3 from unexpected source IPs would spot this lateral movement — if they’re looking.

Once on the domain controller, the group creates a rogue admin account, exfiltrates a snapshot of the file share to a Rclone staging folder pointed at a cloud storage endpoint, and then waits. The exfiltration is the leverage for double extortion — pay or your customer data goes public.

Stage 3: Encryption and Impact

The final payload deploys via a domain Group Policy Object or a remote service push — something that hits every joined host simultaneously. Modern ransomware like LockBit 3.0 uses hybrid encryption: each file gets a unique AES-256 key, and that key is wrapped with the attacker’s RSA-2048 public key. Without the matching private key, decryption is computationally impossible.

On any encrypted host, the file system looks like this after execution:

C:\Users\jharris\Documents\
├── Q2_financials.xlsx.lock3
├── patient_records_2026.csv.lock3
├── system_diagram.vsdx.lock3
└── RESTORE_YOUR_FILES.txt

--- RESTORE_YOUR_FILES.txt ---
Your network has been encrypted by LockBit 3.0.
To recover your files, visit: http://lockbit[.]onion/victim-id-a3f9c2
Decryption key held at: RSA-2048 protected
Deadline: 72 hours. After that, data is published.

The .lock3 extension is the fingerprint — a threat hunter seeing this extension appear across multiple hosts in Elastic or Splunk alerts should immediately trigger your IR runbook. At this point, containment beats everything. Kill the network segment. Don’t reboot encrypted machines — some ransomware variants store the key in memory until reboot, and forensic recovery is occasionally possible from a live image.

Shadow copies are already gone. The ransomware ran vssadmin delete shadows /all /quiet in the first 30 seconds. Backups that were network-accessible are likely encrypted too. The groups know your recovery path better than most sysadmins do.

What To Do Now

Open your SIEM right now and build a detection rule for Event ID 4688 (process creation) where CommandLine contains vssadmin delete shadows. That single command is present in nearly every ransomware execution chain and fires before a single file is touched. Alert on it, page someone immediately, and you buy yourself the window to contain the attack before encryption starts. Set it up today — it takes under ten minutes and covers you against every major ransomware family active in 2026.