Ransomware Anatomy: How Modern Attacks Work End to End

In May 2025, the BlackSuit ransomware group compromised a regional hospital network by chaining a VPN credential stuffing attack with a living-off-the-land lateral movement campaign — encrypting 4,200 endpoints in under six hours. The speed wasn’t magic. It was a repeatable playbook. Understanding that playbook is how you stop it before stage three.

Stage 1: Initial Access and Persistence

Modern ransomware operators rarely write exotic exploits. They buy access. A compromised RDP credential, a phishing link, or an unpatched edge device gets them a foothold. Once inside, the first job is staying alive through a reboot.

Here’s what persistence looks like on a Windows endpoint — pulled from a real-world triage session on a host named CORP-WKS-047:

# Querying the Run key for suspicious entries
reg query HKCU\Software\Microsoft\Windows\CurrentVersion\Run

# Output:
HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run
    WindowsUpdate    REG_SZ    C:\Users\jharris\AppData\Roaming\svchost32.exe
    OneDriveSync     REG_SZ    C:\Program Files\OneDrive\OneDrive.exe

OneDriveSync is legitimate. WindowsUpdate pointing to a binary in a user’s AppData\Roaming folder is not. Real Windows Update components live under System32 or SysWOW64 — never in a user profile. An attacker dropped svchost32.exe (note the 32 suffix — a classic masquerading trick) and registered it to survive logout and reboot.

What you do next: Hash that binary immediately. Run it through VirusTotal or a local sandbox. Pull its network connections with netstat -ano and cross-reference the PID. You’re looking for beaconing to a C2 host.

Stage 2: Reconnaissance, Lateral Movement, and Data Exfiltration

Before encryption, ransomware operators spend days — sometimes weeks — inside the network. They map your domain, identify backups, and exfiltrate sensitive data to use as double-extortion leverage. This is the stage where defenders have the best chance to intervene.

Attackers love built-in tools for this. On a compromised host at 192.0.2.14, a threat actor ran the following to enumerate the domain and locate backup servers:

# Run from compromised host CORP-WKS-047 as user jharris (domain user, no admin yet)
net group "Domain Admins" /domain
net view /domain:CORP
nltest /dclist:CORP

# Partial output:
Group name     Domain Admins
Members
-------------------------------------------------------------------------------
administrator  svc_backup  t.morrison
The command completed successfully.

List of DCs in domain CORP:
    \\DC01.corp.local [PDC]  [DS] Site: DefaultFirstSiteName
    \\DC02.corp.local [DS]  Site: DR-Site

That output hands the attacker three things: the names of domain admin accounts (svc_backup is almost certainly a service account with weak credentials), two domain controllers, and a hint that a DR site exists. The next move is credential harvesting — often via a Mimikatz dump or Kerberoasting — to escalate privileges before touching any files.

Data exfiltration happens quietly over legitimate channels. Operators have been observed using rclone — a cloud sync tool — to push gigabytes to attacker-controlled S3 buckets before a single file gets encrypted. Look for rclone.exe in unexpected directories and large outbound transfers to cloud storage endpoints in your firewall logs.

Stage 3: Encryption and Impact

Once backups are disabled and data is exfiltrated, encryption fires. Modern ransomware uses a hybrid scheme: a fast symmetric algorithm (AES-256 or ChaCha20) encrypts file content, and an attacker-held RSA or elliptic-curve public key encrypts the symmetric key. You cannot decrypt without the private key — period.

Here’s what the file system looks like seconds after detonation on file server FS-PROD-01 (192.0.2.88):

# Output of 'dir \\FS-PROD-01\Finance\Q3Reports' during active encryption
10/26/2026  09:14 AM         204,800 Q3_Revenue.xlsx.BLKSUIT
10/26/2026  09:14 AM         512,000 Payroll_Oct2026.xlsx.BLKSUIT
10/26/2026  09:14 AM               0 !READ_ME_NOW.txt
10/26/2026  09:14 AM         819,200 AuditTrail_2026.pdf.BLKSUIT

# Contents of !READ_ME_NOW.txt
Your network has been compromised by BlackSuit.
All files are encrypted with military-grade encryption.
Contact: support@blacksuit-recover[.]onion
Your unique ID: BKS-2026-447A

The .BLKSUIT extension is the tell. Each victim gets a unique ID — that’s how the operator’s C2 infrastructure tracks which decryption key to hand back if a ransom is paid. The ransom note is always planted in every encrypted directory to maximize visibility and panic.

At this point, containment is the only play. Isolate affected hosts at the switch port or hypervisor level immediately. Do not shut down — memory forensics on a live system can sometimes recover encryption keys or C2 artifacts that disappear on power-off.

What To Do Now

Open your endpoint management console and pull a list of every binary running from AppData\Roaming, AppData\Local\Temp, or user profile directories right now. These paths are writable by standard users — they’re a favorite staging ground for ransomware droppers. Any executable there that isn’t on your application allowlist is worth investigating today, before it matters.