Ransomware Kill Chain: Where Network Controls Bite

By Taylor Thomas · 2026-09-01

A ransomware incident looks sudden from the helpdesk — screens lock, a note appears — but in many human-operated intrusions the encryption follows hours, days, or longer of preparatory activity. Documented operations follow a recognizable arc: get in, establish command and control, find what matters, spread to it, very often steal it, then encrypt. Much of that preparation touches the network, and that is the defender’s arithmetic: each crossing is a potential interception point, and disrupting an earlier dependency can prevent or sharply limit what follows — provided existing access is also hunted down and contained, because operators can hold more than one foothold.

One framing note before walking the arc. MITRE ATT&CK is the widely shared vocabulary and knowledge base here, and its tactics — initial access, lateral movement, exfiltration, impact — are adversary objectives, not a fixed sequence of phases. Real intrusions loop and reorder. Treat the arc below as the common shape of ransomware operations, not a script every operator follows.

Initial Access: Shrinking the Doorways

The common entry paths are unglamorous: phishing that lands a loader or steals credentials, internet-exposed remote access services, and valid accounts bought or reused from prior breaches. Network controls bite here in specific ways. Email security reduces what reaches inboxes. Closing remote access paths that should never have been public removes exposure outright, and multifactor authentication — phishing-resistant where feasible — hardens the services that must stay reachable; the valid-accounts path in particular is a reminder that an intrusion can begin with a login that looks legitimate to every control watching it — a door those controls narrow rather than remove. Intrusion prevention in front of exposed services can block exploitation of known vulnerabilities while patching catches up; it is a control on the window between disclosure and remediation, not a substitute for remediation.

Command and Control: The Attacker’s Own Dependency

Once inside, staged operations typically depend on network communications — for instructions, tooling, and staging — frequently over outbound connections, though operators working through inbound remote access or pre-staged tooling need less of a channel. Where the dependency exists it is a defensive asset, because the channel must traverse your egress. DNS-layer security blocks resolution of known-bad domains before a connection ever forms, for clients actually forced through the protected resolver. Egress filtering that denies outbound traffic by default, permitting only what the environment actually needs, turns “any compromised host can call home” into “the attacker must find an allowed path.” Neither is perfect — determined operators tunnel over permitted protocols, which is exactly why exfiltration techniques like DNS tunneling and HTTPS misuse appear on the SCOR blueprint — but constraints on the channel raise the operator’s cost, and where the enforcement is logged and watched, each one is another chance at a detection.

Lateral Movement: Where Segmentation Earns Its Keep

Between foothold and impact lies movement — discovery of the environment, then spread toward high-value systems, and pointedly toward backups, which mature operators often attempt to find and destroy or encrypt to remove your recovery option. Segmentation is the control aimed at this stage, with a caveat that matters: segmentation limits spread where connectivity between segments is absent, or where an enforcement point along the path — a firewall, a filtering layer 3 boundary, group-based enforcement at the port — denies the traffic. VLANs separate at layer 2, but once unrestricted routing connects them, the VLAN boundary itself imposes no access policy on movement between segments — separation without enforcement. Effective designs put policy between user space and server space, between production and backup infrastructure, and around the identity systems whose compromise can grant broad access to everything else — and pair it with detection of movement itself, because containment and detection cover for each other’s gaps.

Exfiltration and Impact: The Last Clear Chances

Double extortion changed the endgame: in these operations the data is stolen before it is encrypted, so publication can be threatened even against a victim who restores flawlessly from backup. That makes the exfiltration stage a detection opportunity with real stakes — flow telemetry and network monitoring, given baselines and analytics watching them, can help surface unusually large or unusually directed outbound transfers while they are happening. The encryption stage itself is a poor place to pin detection hopes: once it begins, the containment window can be very short, and response at that point is damage limitation. Backups remain essential for recovering from it; they are simply not sufficient alone, because restoring systems does not un-steal data.

Reading the Chain as a Design Tool

The arc is ultimately a budgeting device. Map your controls to stages and the gaps show: an environment with strong email security but flat internal networks has bet heavily on stopping stage one, and an environment blind to its own egress gives up one of its clearest looks at two stages where the attacker must often show themselves. Not every worthwhile control maps to a single stage — recovery, identity protection, and governance cut across the arc — but a stage map keeps coverage claims honest. On the certification map, this is core SCOR 350-701 territory — objective 1.1 covers the threat landscape including malware and phishing, and 6.5 covers the exfiltration techniques double-extortion endgames rely on. The SCOR course builds the controls in this article on real gear, stage by stage.

Frequently Asked Questions

What are the typical stages of a ransomware attack?

Human-operated ransomware intrusions typically follow a recognizable arc: initial access through phishing, exposed remote services, or valid stolen credentials; establishment of command and control; discovery and lateral movement to reach high-value systems and backups; frequently data exfiltration; and only then encryption. The arc is a pattern, not a script — operators reorder and revisit stages — but the pattern is what gives defenders multiple chances to detect and contain before the impact stage.

Why doesn't having good backups fully solve ransomware?

Backups support recovery from the encryption stage, and mature operators plan for that: they often attempt to move laterally to backup infrastructure and delete, disable, or encrypt reachable backups before or during the impact stage, and they exfiltrate data before encrypting so they can threaten publication regardless of recovery. Restoring systems does not un-steal the data. Backups remain essential for recovery — they are simply not sufficient as the only control, which is why the pre-encryption stages are worth defending on their own.

Which network controls matter most against ransomware?

The ones that face the stages your other controls miss. Email and web protections reduce initial access; DNS-layer security and egress filtering can block or constrain many command-and-control paths; intrusion prevention can block exploitation of exposed services; segmentation slows lateral movement toward critical systems and backups; and flow telemetry provides the metadata that can reveal large or unusual outbound transfers — the exfiltration stage. No single one is decisive, and that is the point of aligning them to stages.