Ransomware Anatomy: How Modern Attacks Work End to End

In March 2026, a mid-sized logistics firm lost 11 days of operations after a single phishing email dropped a LockBit 4.0 variant on their network. The ransom note appeared on 340 endpoints simultaneously. Understanding exactly how that chain works — step by step — is the fastest way to find where defenders can break it.

Stage 1: Initial Access and Persistence

Modern ransomware rarely executes immediately after delivery. First it establishes a foothold. The most common path in 2026 is still a phishing attachment that drops a loader, which then beacons out to a command-and-control server.

After initial compromise, the attacker runs a quick situational awareness sweep. Here is what that looks like from an endpoint telemetry perspective — captured from a Velociraptor hunt on host WS-CORP-114 (192.0.2.47):

# Velociraptor artifact: Windows.System.ProcessCreation
Timestamp          PID   PPID  User          CommandLine
2026-09-03 02:14:11  4821  1204  corp\jharris  cmd.exe /c whoami
2026-09-03 02:14:13  4823  4821  corp\jharris  net localgroup administrators
2026-09-03 02:14:17  4825  4821  corp\jharris  nltest /domain_trusts
2026-09-03 02:14:22  4829  4821  corp\jharris  wmic shadowcopy list brief

Four commands in eleven seconds, spawned from a parent PID that belongs to Outlook. That is a textbook hands-on-keyboard recon sequence. whoami confirms the compromised account, net localgroup administrators checks for local privilege, nltest maps domain trusts for lateral movement planning, and wmic shadowcopy list brief is the attacker checking whether VSS snapshots exist before they delete them.

A defender seeing this chain should immediately isolate WS-CORP-114, pull memory, and check for scheduled tasks or registry run keys added under HKCU\Software\Microsoft\Windows\CurrentVersion\Run. The presence of that shadow copy query is a near-certain indicator that encryption is coming soon.

Stage 2: Lateral Movement and Privilege Escalation

Ransomware operators want domain admin before they detonate. More encrypted hosts means more leverage. They move laterally using stolen credentials, often via PsExec, WMI, or — increasingly — legitimate RMM tools already installed in the environment.

Here is a Zeek (formerly Bro) SMB log snippet from the network segment containing the domain controller DC-CORP-01 (192.0.2.10), captured around the same timeframe:

# Zeek smb_cmd.log (trimmed)
ts                  src_ip        dst_ip       command       argument
2026-09-03 02:19:04  192.0.2.47   192.0.2.10   TREE_CONNECT  \\DC-CORP-01\ADMIN$
2026-09-03 02:19:05  192.0.2.47   192.0.2.10   CREATE        \PSEXESVC.exe
2026-09-03 02:19:06  192.0.2.47   192.0.2.10   WRITE         \PSEXESVC.exe
2026-09-03 02:19:08  192.0.2.47   192.0.2.10   IOCTL         PSEXESVC

The workstation at 192.0.2.47 is writing PSEXESVC.exe to the domain controller’s ADMIN$ share and then starting it as a service. That is PsExec lateral movement in four log lines. From here the attacker runs credential dumping — typically LSASS via a direct syscall loader to evade EDR — and harvests domain admin hashes.

Once they have domain admin, they typically deploy the ransomware binary via Group Policy or a startup script, staging it in a writable share. On network-aware variants, they also target NAS devices and backup servers first, specifically to eliminate recovery paths.

Stage 3: Encryption and Detonation

Modern ransomware uses a hybrid cryptographic scheme. A unique AES-256 key encrypts each file. That AES key is then wrapped with the attacker’s RSA or ECC public key. Without the attacker’s private key, decryption is mathematically infeasible.

The encryption phase is fast — deliberately so. LockBit variants in particular use intermittent encryption (encrypting only the first 4 KB of large files) to maximize the number of files corrupted before EDR catches up. A quick look at file system activity right before a ransom note drops:

# MFT change journal — output from analyzeMFT on \\FILESVR-01 (192.0.2.88)
Timestamp            Filename                          Reason
2026-09-03 02:31:44  D:\Finance\Q3_report.xlsx         DATA_OVERWRITE | CLOSE
2026-09-03 02:31:44  D:\Finance\Q3_report.xlsx.lk4     FILE_CREATE
2026-09-03 02:31:45  D:\Finance\payroll_aug2026.xlsx   DATA_OVERWRITE | CLOSE
2026-09-03 02:31:45  D:\Finance\payroll_aug2026.xlsx.lk4  FILE_CREATE
2026-09-03 02:31:46  D:\Finance\README_RESTORE.txt     FILE_CREATE

Every original file is overwritten and a .lk4 encrypted copy is created alongside it. The final line — README_RESTORE.txt — is the ransom note. At this point the encryption run is either complete or still in progress. Pulling the network cable stops further spread but the encrypted files are already gone.

After detonation, operators in 2026 almost always follow up with a data exfiltration threat. They exfiltrated before encrypting — the encryption is the second pressure point, not the first.

What To Do Now

Pull up your SIEM and run a query for any process chain where wmic shadowcopy delete or vssadmin delete shadows appears as a child of a user-space process in the last 30 days. That single query catches a huge percentage of pre-detonation ransomware activity before encryption starts. If you get a hit, you have a live incident — isolate the host and start your IR playbook immediately.