Understanding Ransomware: How It Spreads and How to Stay Safe

Your files are gone. Not deleted — encrypted, renamed, sitting behind a lock you don't have the key to. A note appears on your screen with a payment deadline and a Bitcoin address. Somewhere on the network, a machine you never thought twice about is quietly talking to a server in a country you've never visited.

That is ransomware, and in 2026 it is no longer a smash-and-grab crime. It is a business with project managers, negotiators, and customer support. Understanding how it spreads — and, more importantly, how it reaches you — is the difference between reading about it and living through it.

I've helped three small organisations rebuild after attacks. Two had backups. One did not, and that one is still paying for it, in ways that have nothing to do with money. Here is what actually matters.

Understanding ransomware: how it spreads and why the front door is usually yours

The dirty secret of ransomware is that the encryption part — the scary part, the part you see on the news — is late in the game. The infection begins days or weeks earlier, quietly, often through a login that should never have been exposed to the internet.

I once audited a small accounting firm that had a server with Remote Desktop Protocol open to the public internet. No MFA. The password was the company name plus the year. When I ran a quick scan from my own laptop, the login prompt appeared in under a second. Nobody had ever looked for it.

The four paths in

Across the incidents I've been involved with, the entry point almost always falls into one of these:

• Exposed remote access. RDP or a VPN appliance with weak credentials, reachable from anywhere. This is the top way infections occur in the cases I've seen.
• Phishing and spear-phishing. A malicious attachment, a link to a fake login page, or simply a convincing email that gets someone to approve an MFA prompt.
• Unpatched software. A known vulnerability on a server nobody rebooted since the last quarterly maintenance window.
• MSP or supply-chain compromise. An attacker gets into your IT provider and then walks into every client network at once. This one hurts the most, because the trust is already established.

Notice what's missing: nobody "cracked" anything clever. They found an unlocked door and tried the handle.

What are the 7 stages of a ransomware attack?

The seven stages describe the full lifecycle, from the first probe to the final negotiation. Knowing them helps you spot an attack before the encryption starts — which is the only moment where you can act cheaply.

1. Reconnaissance. The attacker scans your public IP ranges, checks leaked credential dumps, and looks at LinkedIn to figure out who works where.
2. Initial access. They log in via RDP, a phishing click, or an exploited vulnerability. At this point, they are a guest.
3. Establishing persistence. They create a new admin account, install a backdoor, or schedule a task so they survive your first cleanup.
4. Privilege escalation. They move from a normal user to domain admin, usually by finding credentials lying around in memory or configuration files.
5. Lateral movement and exfiltration. They map your network, then copy the interesting files somewhere else. This can take weeks.
6. Encryption. The actual ransomware payload fires, usually overnight or on a Friday afternoon. It encrypts what it can reach and leaves the note.
7. Extortion and negotiation. The demand arrives. Increasingly, the threat is not "we'll keep your files" but "we'll publish them."

The critical insight is that stages one through five are quiet. If your only detection is a file with a weird extension, you've missed five opportunities to stop it.

How does ransomware malware spread once it's inside?

This is where the "malware" label is slightly misleading. Modern ransomware doesn't just multiply on its own — it is deployed by a human operator who has spent days or weeks setting up.

The spread inside a network relies on:

• Shared network drives, which are encrypted simultaneously from the machine that has access to them.
• Unpatched internal systems, including the server everyone forgot about.
• Cached credentials, harvested from memory on machines the attacker has already compromised.
• Scripts pushed through group policy or management tools — the attacker uses your own administration tools against you.

This is why network segmentation matters so much. If a compromised laptop can reach every server, so can the malware.

What is the 3/2/1 rule for ransomware?

The 3/2/1 rule states that you should keep three copies of your data, on two different storage media types, with one copy stored offsite. For ransomware specifically, there is an unspoken fourth requirement: one of those copies must be offline or immutable.

A backup that lives on a network share and uses the same credentials as your domain admin is not a backup. It is a second target. I've seen a company with a nightly backup job that ran flawlessly for four years, right up until the attacker deleted the backup repository on day two of the intrusion.

Why one offline copy is non-negotiable

The whole point of encryption is that the attacker needs you to pay. If they can also delete your restore points, they have removed your only alternative. An offline copy — a tape, a removable disk left disconnected, a cloud bucket with write-once settings — is the one thing a remote attacker cannot touch.

And a backup you've never tested is a hypothesis, not a backup. The firm I mentioned earlier had "backups." When we tried to restore, half the files were corrupt, and the restore took eleven hours for a single terabyte. That is a disaster within a disaster.

What do hackers hate the most?

They hate friction. Every obstacle that slows them down either costs them money or sends them looking for an easier target.

In practice, the things that make an operator abandon an intrusion are mundane:

• Multi-factor authentication on every remote login. Not just for admins — for everyone who can reach a system remotely.
• Network segmentation. If the marketing subnet cannot talk to the finance server, lateral movement stalls.
• The principle of least privilege. Users who don't have admin rights on their own laptop are a much smaller problem.
• Tested, offline, immutable backups. The one thing that removes the leverage entirely.
• Logging that someone actually reads. A 3 a.m. alert about an impossible login is worth more than a thick policy document.

None of this is exotic. It is just tedious, and tedium is exactly what attackers are counting on you to skip.

Staying safe in 2026: the short list that actually works

You don't need a security operations centre. You need a handful of controls applied consistently.

Control	Effort	Impact
MFA on all remote access	Low	Very high
Offline / immutable backup with tested restores	Medium	Very high
Patch management on a schedule	Medium	High
Network segmentation	High	High
Least privilege for users	Medium	Medium–high
Email filtering and user training	Low	Medium
Log monitoring	High	Medium

What I would do first, in this order

If you only have a weekend, do this: turn on MFA for every remote login, disconnect any RDP that doesn't absolutely need to be public, and verify that one backup is genuinely offline. That combination defeats the vast majority of the intrusions I've personally encountered.

Then, when you have more time, work through the rest. A patch cycle that runs monthly and actually completes is worth more than a perfect policy nobody follows.

The uncomfortable part is that none of this is dramatic. There is no single product that "stops ransomware." There is only a series of small, boring habits that make you a harder target than the next company on the list — and that, in the end, is the entire game.