The Complete Ransomware Guide for Australian Businesses

Credential theft and harvesting

The attacker dumps credentials from the first machine using tools like Mimikatz or LSASS memory extraction. They collect saved passwords, browser cookies, and session tokens. Within minutes they have credentials for service accounts, admin accounts, and any other user who logged into that machine. MFA slows this down but does not stop it if the attacker uses adversary-in-the-middle (AiTM) phishing to intercept MFA tokens.

Lateral movement via RDP, PsExec and WMI

Using stolen credentials, the attacker moves to other machines via Remote Desktop Protocol, PsExec, Windows Management Instrumentation, or SMB file sharing. These are built-in Windows administration tools, so they do not trigger antivirus. The attacker is effectively a legitimate admin at this point. Every machine they reach gives them more credentials to harvest.

Domain controller compromise

In environments with an on-premises Active Directory domain controller, the attacker escalates to domain admin using techniques like Kerberoasting or pass-the-hash. Once they own the domain controller, they own every account, every machine, and every service in the environment. This is the point of no return for many attacks.

Reconnaissance and target selection

The attacker maps the network, identifies file shares, databases, backup systems, and cloud connections. They look for the backup server or NAS first, because destroying backups before encryption prevents recovery. They also identify high-value data for exfiltration, which is used for the double extortion leverage.

Backup deletion and data exfiltration

Before any encryption begins, the attacker silently deletes or corrupts backups, unmounts NAS volumes, and disables recovery services. They also exfiltrate sensitive data through tools like RClone or Mega, uploading it to attacker-controlled storage. This stage can take hours or days, and it is completely silent. Most businesses do not know it is happening.

Mass encryption

Once backups are gone and data is stolen, the attacker deploys the ransomware payload across as many machines as possible simultaneously. This is the stage everyone notices: files are encrypted, ransom notes appear, systems stop working. But by this point the attack has been inside for hours, days, or sometimes weeks.

Verify backup integrity

Do not restore blindly. Test one file first. Confirm backups predate the intrusion (often weeks earlier than encryption).

Forensic investigation

Understand how they got in, what was taken, and whether persistence remains. Skipping this means reinfection.

Rebuild, do not clean

Wipe infected systems. Reinstall fresh. Restore data, not the OS. Clean rebuild is the only reliable path.

Rotate all credentials

Every password, every service account, every API key. Assume all were seen.

Notify stakeholders

Customers, staff, regulators. Privacy Act breach notifications to OAIC within 30 days of becoming aware.