English
Español
Cybersecurity
Cybersecurity9 min read
Ransomware in 2025: Prevention, Detection and Response.
How ransomware works in 2025
Modern ransomware is not a simple virus that encrypts files. It is a sophisticated multi-stage attack executed by specialised criminal groups with a business structure. The Ransomware-as-a-Service (RaaS) model allows operators to licence their malware to affiliates who conduct the actual attacks.
The most critical phase is not encryption — it is lateral movement before detonation. Attackers spend weeks inside the network, exfiltrating data and mapping critical systems. When they finally trigger the ransomware, the pressure is twofold: pay for decryption, or watch confidential data leaked publicly.
Attack phases: TTPs and MITRE mapping
T1566
Initial Access
Phishing with weaponised Office macros or malicious PDF. Exploitation of unpatched public-facing services (VPN, Exchange).
T1078
Valid Accounts
Credential stuffing from leaked databases. Brute force against RDP. Stolen session cookies bypassing MFA.
T1021
Lateral Movement
Pass-the-hash, PsExec, WMI abuse. Movement towards domain controllers and backups before detonation.
T1486
Data Encryption
Hybrid encryption (RSA + AES-256). Shadow Copy deletion. Backup destruction to prevent recovery without paying.
Educational YARA example: suspicious command strings
This rule searches files or process memory for two command strings. A match does not prove that either command ran or that ransomware is present; legitimate scripts and documentation can also match. It does not detect behaviour, prevent encryption or isolate a host. Correlate findings with process and security telemetry before taking action. See the official YARA rule documentation.
rule ShadowCopyCommandStrings {
meta:
description = "Educational string triage; not behaviour detection"
strings:
// Presence of text is not evidence of command execution.
$vss = "vssadmin delete shadows" ascii wide nocase
$wmic = "wmic shadowcopy delete" ascii wide nocase
condition:
any of ($vss, $wmic)
}
"Paying the ransom does not solve the problem. Without knowing how they got in, they will be back in 90 days."
Zenith — Primitive Labs
Incident response checklist (first 72h)
- 01
Isolate — Disconnect affected systems without shutting them down. Preserve forensic evidence in memory.
- 02
Identify — Determine ransomware family (ID Ransomware), find patient zero and entry point.
- 03
Notify — AEPD if personal data is involved. Legal, insurance, and management stakeholders.
- 04
Recover — Restore from offline backups verified before the attack. Do not restore to the same compromised environment.
- 05
Harden — Patch the exploited vector, rotate all credentials, enforce MFA, and implement EDR monitoring.
Tags :
RansomwareIncident ResponseYARACybersecurityMITRE
