The same chain, over and over. Four steps, one outcome, zero variety. If you work a few incidents a year you stop being surprised - and you start seeing exactly where to break it.
Step 1 - Initial access via phishing
Still a Microsoft 365 OAuth consent prompt, or a spoofed invoice PDF dropping a first-stage loader. Native M365 filtering catches the bulk, misses the targeted. The user clicks because the email looked like it came from a supplier they do business with.
Step 2 - Credential harvest and lateral move
Loader pulls Mimikatz or an LSASS dumper (MITRE ATT&CK T1003). Harvested creds get replayed against the on-prem AD. Because a service account has domain admin rights (it shouldn't), the attacker is now in the crown jewels within 30 minutes of the click.
Step 3 - Exfiltration before encryption
Modern ransomware doesn't just lock files - it copies them first. Rclone to a cloud bucket, or a staged archive to a hosting provider (T1567). This is where double-extortion comes from: "pay or we leak."
Step 4 - Encryption at 3am on a Saturday
Timed to minimise response. Backups on the same AD get hit first. The business wakes up to a ransom note and no usable recent backup.
Three interventions that break the chain
- MFA on every admin and VPN account. Kills the replay in Step 2 for the majority of attackers. Non-negotiable.
- Backups isolated from AD. Immutable, separate credential domain. If the attacker reaches your backups, you have no recovery.
- Behavioural antivirus with automated containment. Signature AV sees nothing; behaviour-based catches LOLBin chains and kills them before Step 3.
None of these are exotic. None require a six-figure SOC. They are the difference between a Monday standup and a Monday press release.
Sources
- CISA #StopRansomware Guide The joint CISA, FBI, NSA and MS-ISAC guide. Its prevention section lists the same three controls as this post.
- MITRE ATT&CK T1003: OS Credential Dumping Mimikatz and LSASS dumping, step 2.
- MITRE ATT&CK T1567: Exfiltration Over Web Service Rclone and cloud-bucket exfiltration, step 3.
- MITRE ATT&CK T1486: Data Encrypted for Impact Step 4.
- Verizon Data Breach Investigations Report Annual figures on ransomware prevalence and the human element in breaches.
- CIS Critical Security Controls MFA, backup isolation and endpoint defence as baseline controls for small organisations.