English
Español
Cybersecurity9 min read
Ransomware in 2025: Prevention, Detection and Response.
How ransomware works in 2025
Modern ransomware is not a simple virus that encrypts files. It is a sophisticated multi-stage attack executed by specialised criminal groups with a business structure. The Ransomware-as-a-Service (RaaS) model allows operators to licence their malware to affiliates who conduct the actual attacks.
The most critical phase is not encryption — it is lateral movement before detonation. Attackers spend weeks inside the network, exfiltrating data and mapping critical systems. When they finally trigger the ransomware, the pressure is twofold: pay for decryption, or watch confidential data leaked publicly.
Attack phases: TTPs and MITRE mapping
T1566
Initial Access
Phishing with weaponised Office macros or malicious PDF. Exploitation of unpatched public-facing services (VPN, Exchange).
T1078
Valid Accounts
Credential stuffing from leaked databases. Brute force against RDP. Stolen session cookies bypassing MFA.
T1021
Lateral Movement
Pass-the-hash, PsExec, WMI abuse. Movement towards domain controllers and backups before detonation.
T1486
Data Encryption
Hybrid encryption (RSA + AES-256). Shadow Copy deletion. Backup destruction to prevent recovery without paying.
Defence: YARA detection rules for
ransomware
Detect ransomware TTPs before detonation using behaviour patterns and file system artefacts.
rule RansomwareBehavior {
meta:
description = "Detects ransomware pre-encryption behaviour"
severity = "CRITICAL"
strings:
// Shadow copy deletion via vssadmin
$vss = "vssadmin delete shadows" nocase
// WMI backup deletion
$wmic = "wmic shadowcopy delete" nocase
// Recursive file enumeration
$enum = { 48 8B 45 ?? 48 8B 48 ?? E8 ?? ?? ?? ?? }
condition:
any of them
}
"Paying the ransom does not solve the problem. Without knowing how they got in, they will be back in 90 days."
Zenith — Primitive Labs
Incident response checklist (first 72h)
- 01
Isolate — Disconnect affected systems without shutting them down. Preserve forensic evidence in memory.
- 02
Identify — Determine ransomware family (ID Ransomware), find patient zero and entry point.
- 03
Notify — AEPD if personal data is involved. Legal, insurance, and management stakeholders.
- 04
Recover — Restore from offline backups verified before the attack. Do not restore to the same compromised environment.
- 05
Harden — Patch the exploited vector, rotate all credentials, enforce MFA, and implement EDR monitoring.
