2. The Current Threat Model: What Happens Before Encryption

2.1 First, Do Not Treat Ransomware Itself as the Entire Threat

In contemporary incidents, intrusion, theft and abuse of credentials, acquisition of administrative privilege, data collection, exfiltration, encryption, and negotiation may each be carried out by different tools or different individuals. If defenders track only “whether ransomware was detected on an endpoint,” they will miss preparatory actions that precede encryption, or extortion that does not involve encryption at all.

The model in this chapter is not a procedure that reproduces any specific real-world incident. It is an abstraction, for operational design purposes, of the defensive perspectives presented by CISA and IPA. [S01][S06]

2.2 Initial Access: The Entry Point Is Not Just a “Hole”

The five areas that should generally be guarded against as initial access are as follows.

The error here is to think that “the entry point is closed because phishing countermeasures were implemented.” The Verizon 2025 DBIR treats abuse of credentials and exploitation of vulnerabilities as significant elements among known initial-access routes. Rather than perfecting a single route, defense becomes a layered design that reduces the conditions for compromise across multiple routes. [S03]

2.3 Foothold and Reconnaissance: Do Not Overlook the Signs of Compromise

After gaining a foothold, attackers survey “what is there.” From the defender’s perspective, it is not sudden encryption but the following changes that precede it that become the important observation points.

• Successful authentication from a location, time, or device not normally used.
• New multi-factor authentication factors, conditional-access exceptions, app consent, or email-forwarding settings.
• Additions to administrative groups or privileged roles, or increased use of shared accounts.
• Anomalous connections to the administration consoles of management servers, identity infrastructure, backup, virtualization, or security products.
• Brief reconnaissance spanning multiple systems, or a concentration of access to shares, directories, or critical data.

No single item on its own can be conclusively judged malicious. Nighttime administrative operations, for example, also occur during maintenance. This is precisely why judgment must combine asset criticality, users’ normal behavior, change requests, endpoint health, and other logs. Beyond simply collecting logs, it is necessary to decide who makes the judgment, who is called at night, and which actions may be automatically blocked.

2.4 Privilege Escalation and Lateral Movement: Why the Management Plane Must Be Protected

What is dangerous in a ransomware attack is not individual data servers alone. Identity providers, directories, virtualization infrastructure, backup management, EDR/MDM, cloud tenants, and network management are all part of a management plane whose influence extends across numerous systems. If this is compromised, an attacker may be able to pursue changes to defensive settings, addition of credentials, and reaching recovery assets, among other objectives.

What is important in understanding this structure is that inspecting individual endpoints (guest OSes) alone does not confirm the safety of the management layer above them. In configurations where administrative credentials and control mechanisms exist in a layer separate from the guest OS, the absence of malware found on the endpoint side may not be sufficient grounds for judging the trustworthiness of the environment as a whole.

Operational judgment: A management plane of high importance should not be placed within the same trust boundary as ordinary business endpoints or general internet browsing. Consider dedicated administrative endpoints, strong authentication, least privilege, approval-gated temporary privilege elevation, detailed logging, and out-of-band emergency access.

Simply having “segmented the network” is also insufficient. Verify, using actual privileges, how far administrative accounts, synchronization accounts, backup agents, remote administration tools, and cloud administrators that cross segmentation boundaries can reach.

Figure 4: The Management Plane and Trust Boundaries

If any one of these trust relationships is connected without limit under strong privilege, a localized compromise can readily turn into a broad outage. The purpose here is not to present a product configuration, but to review privilege and reachability.

2.5 Data Exfiltration: Confidentiality Breaks Down Together With Availability

In double extortion, attackers may exfiltrate data before encryption. Consequently, even where decryption or backup recovery succeeds, the investigation of information leakage and consideration of notification obligations still remain. CISA’s advisory on Play describes double extortion involving encryption following data theft. [S08]

What is needed at this stage is not to search for exfiltration by looking only for “large volumes of traffic to external IPs.” When cloud storage, legitimate file sharing, administrator accounts, or outsourcing-partner integration is used, the traffic may be encrypted and resemble ordinary business activity. Only with classification of critical data, access auditing, a baseline of normal-time data movement volume, and a history of approvals for external sharing does judging an anomaly become easier.

2.6 Execution and Extortion: Do Not Wager Everything on the Final Stage

Signs of encryption can include a large volume of file changes in a short period, simultaneous failures across multiple hosts, and anomalous operations on recovery assets or security settings. However, reducing damage to zero after detection is difficult. If the moment of encryption alone is set as the detection target, defenders lose the time that attackers used for preparation.

The ransom-demand screen, emails, and postings on leak sites can be important evidence. Beyond screenshots, preserve the time, target systems, communication logs, change history, and affected accounts in a manner that does not alter them. Whether to contact the attacker should not be decided immediately by technical staff alone. A decision-making structure involving legal, management, insurance, outside experts, and, where necessary, investigative authorities should be established in advance, during normal operations.

2.7 A Caution on Reading Current Statistics

IC3 reported, for 2025, more than 3,600 ransomware complaints and losses exceeding US$32 million. [S02] However, this figure does not represent the full total of ransoms paid, stoppage losses, recovery costs, lost profits, legal costs, and recurrence-prevention costs. Reporting rates and classifications may also differ from the 2,825 complaints and over US$59.6 million reported for 2023, and the 2,385 complaints and over US$34.3 million reported for 2022. [S12][S13]

These figures are evidence of the degree of danger, not a precise price list. An organization’s own priorities should be determined not by external statistical rankings, but by the business impact of a stoppage, recovery time, the data held, connected parties, and privilege structure.