The ransom note is the last thing that happens in a ransomware attack, not the first. By the time files stop opening and a text file appears on every desktop, the attackers have usually been inside for some time. They have found a way in, made sure they can get back, collected passwords, mapped the network, switched off what they could of the security tools, copied data out and gone after the backups. Encryption is the final step.

That sequence matters to defenders because every stage before the last one is a chance to catch the intrusion. This guide walks through the stages as U.S. government advisories describe them, using CISA's #StopRansomware Guide, two joint #StopRansomware advisories on the Akira and SafePay groups, and the MITRE ATT&CK framework that those advisories use to label attacker behavior. It describes what attackers do and how to spot and stop them. It does not explain how to carry out any of it.

A quick word on the framework

MITRE ATT&CK is a public catalog of attacker behavior built from real-world observations. Its top level is a set of "tactics," each describing the attacker's goal at that moment, such as Initial Access ("trying to get into your network"), Credential Access ("trying to steal account names and passwords") or Impact ("trying to manipulate, interrupt, or destroy your systems and data"). The current version, ATT&CK v20, lists 15 enterprise tactics (as of October 2026). Joint advisories from the FBI and CISA map each group's activity to these tactics, which makes it easier to compare groups and check your own defenses against them.

Real intrusions don't always follow the stages in a straight line. Attackers loop back to steal more credentials or move again once they have better access. The broad order below is still the pattern the advisories describe again and again.

Stage 1: Getting in

CISA's #StopRansomware Guide, written with the FBI, NSA and the Multi-State Information Sharing and Analysis Center (MS-ISAC), groups its prevention advice by the most common ways in:

  • internet-facing vulnerabilities and misconfigurations
  • compromised credentials
  • phishing
  • precursor malware infections
  • advanced forms of social engineering
  • third parties and managed service providers

The two advisories show what that looks like in practice. The FBI and cybersecurity researchers cited in the advisory say Akira actors have gotten in through VPN services that did not have multifactor authentication (MFA) set up, mostly by exploiting known CVEs. They have also used spearphishing, stolen valid credentials, exposed services such as Remote Desktop Protocol (RDP), brute-forcing of VPN logins, password spraying, and possibly access bought from initial access brokers. The advisory, first published in April 2024 and updated November 13, 2025, lists the flaws used. All eight are in CISA's Known Exploited Vulnerabilities catalog, and CISA flags each one as used in ransomware campaigns. They include Cisco firewall flaws CVE-2020-3259 and CVE-2023-20269 and SonicWall flaw CVE-2024-40766.

The SafePay advisory, published October 20, 2026, by agencies including the FBI, CISA and the U.S. Secret Service, describes the same pattern. It says the FBI, the Secret Service and cybersecurity researchers saw SafePay actors get in through exposed credentials, brute-force password attacks and VPN access. They also used phished accounts to exploit known flaws in edge devices.

Precursor malware is a route of its own. The #StopRansomware Guide warns that a ransomware event "may be evidence of a previous, unresolved network compromise." It also notes that operators of precursor "dropper" malware such as QakBot, Emotet and Bumblebee "will often sell access to a network." The group that encrypts your files may not be the one that first broke in.

Stage 2: Staying in and blending in

Once inside, attackers make sure they can come back if a password is reset or a machine is rebuilt. The Akira advisory describes actors creating new domain accounts, and in some cases adding new user accounts to the administrators group. The SafePay advisory describes actors creating new accounts or taking over existing ones.

A recurring theme is the misuse of legitimate software. The Akira advisory says the group abuses remote access tools such as AnyDesk and LogMeIn "to maintain persistence and blend in with administrator activity." The #StopRansomware Guide tells responders to look for "any unexpected usage of remote monitoring and management (RMM) software," including portable copies that were never installed. Tools your IT staff use every day are hard to flag as malicious, which is exactly why attackers use them.

Stage 3: Stealing credentials and climbing

To reach the servers that matter, attackers need administrator-level access. The Akira advisory describes Kerberoasting and extracting credentials from the memory of the Windows Local Security Authority Subsystem Service (LSASS), along with credential-scraping tools such as Mimikatz and LaZagne. The SafePay advisory says that group also uses Mimikatz, a well-known credential-theft tool. In one Akira case, the actors powered down a domain controller's virtual machine and copied its disk files to pull out the credential database, which gave them a highly privileged domain administrator account.

The #StopRansomware Guide's threat-hunting list reflects this stage. It tells defenders to look for newly created Active Directory accounts or accounts with escalated privileges, suspicious activity by privileged accounts such as Domain Admins, and signs that Active Directory has been enumerated or LSASS credentials dumped.

Stage 4: Mapping the network and moving through it

With credentials in hand, attackers survey the environment and spread. The Akira advisory names ordinary network scanners, including SoftPerfect, Advanced IP Scanner and NetScan, and says the group moves laterally with legitimate remote access tools, RDP and SSH. The SafePay advisory describes actors using "legitimate system tools to move through the network, identify valuable files, and disable security protections."

Flat networks make this stage easy. The #StopRansomware Guide recommends network segmentation because it "can help contain the impact of any intrusion" and "prevent or limit lateral movement."

Stage 5: Turning off the alarms

Before the noisy part of the attack, groups try to blind defenders. The Akira advisory says the group commonly disables security software before moving laterally. It has abused a vulnerable antimalware driver to kill antivirus processes and has uninstalled endpoint detection and response (EDR) tools. In ATT&CK v20 this kind of activity falls under the Defense Impairment tactic, for example technique T1685, Disable or Modify Tools. Defense Impairment covers attempts "to break security mechanisms, pipelines, and tooling so defenders can't see or trust what's happening." It is separate from the Stealth tactic, which MITRE limits to hiding activity without modifying security controls. An EDR agent that suddenly stops reporting is an alert in itself, not just a maintenance ticket.

Stage 6: Taking the data

Many ransomware attacks today are "double extortion." CISA describes it as encrypting systems and also stealing data, then threatening to publish it. Some groups skip encryption entirely and extort with stolen data alone. The advisories describe data being bundled with archiving tools such as WinRAR and sent out with FileZilla, WinSCP, Rclone or cloud storage services. The #StopRansomware Guide also names tunneling tools that hide traffic inside normal-looking HTTPS connections.

This stage can be fast. The updated Akira advisory says that in some incidents the actors exfiltrated data "in just over two hours from initial access." Abnormal amounts of outbound data are one of the hunting signals CISA lists.

Stage 7: Killing the way back

Just before encryption, attackers go after anything that would let the victim recover without paying. MITRE's Inhibit System Recovery technique (T1490) describes adversaries who "delete or remove built-in data and turn off services designed to aid in the recovery of a corrupted system." The Akira advisory says its encryptor deletes Windows Volume Shadow Copy snapshots. The #StopRansomware Guide warns that "many ransomware variants attempt to find and subsequently delete or encrypt accessible backups."

Backup servers are targets in their own right. Two of the flaws in the Akira advisory, CVE-2023-27532 and CVE-2024-40711, are in Veeam Backup & Replication. The advisory describes actors exploiting them on unpatched Veeam backup servers.

Stage 8: Encryption and the ransom note

The final step is ATT&CK technique T1486, Data Encrypted for Impact: encrypting files on local and network drives and withholding the key. MITRE notes that adversaries may also encrypt virtual machines on ESXi or other hypervisors. That lets one action take down many servers at once. The Akira advisory says the group deployed a Linux variant against VMware ESXi virtual machines starting in April 2023. It also says the group encrypted Nutanix AHV virtual machine disk files in a June 2025 incident, the first time it was observed doing so.

Then comes the note. According to the advisory, Akira's note gives each victim a unique code and a Tor address to make contact, with no ransom amount or payment instructions until the victim reaches out. Payment is in Bitcoin, and the FBI says the group has threatened to publish stolen data and in some cases phoned victims. SafePay's note, left on the desktop or in the root directory, links to a leak site where the group posts data if the victim does not pay. A representative also makes pressure calls, and demands are typically pegged to a share of company revenue. The Akira advisory says that group had claimed approximately $244.17 million in ransom proceeds as of late September 2025. The SafePay advisory says that group has hit at least 600 victims since August 2024.

The FBI and CISA "do not encourage paying ransom," because payment does not guarantee files will be recovered and may encourage further attacks. Whether or not a victim pays, they ask that the incident be reported.

What It Means for Defenders

The useful lesson from the stages is that most of the attack happens before encryption, and most of it relies on access you can deny or activity you can spot. Drawing on that government guidance, a few priorities stand out:

  • Close the front doors. Do not expose RDP to the internet, put phishing-resistant MFA on every VPN and remote-access login, and patch internet-facing systems quickly, especially for flaws in CISA's KEV catalog. Akira and SafePay both relied on VPNs and edge devices. Recent cases such as the FortiBleed credential campaign and the Welsh public body breached through a weak test account show the same pattern.
  • Protect backups as if they were a target, because they are. Keep offline, encrypted backups, test restores regularly, keep "golden images" of critical systems, and patch the backup server itself.
  • Watch for the middle stages. CISA's hunting list is a good starting checklist: new or newly privileged accounts, odd VPN logins, unexpected RMM tools or PowerShell, signs of credential dumping, unusual endpoint-to-endpoint traffic, large outbound transfers, and misuse of built-in tools that delete shadow copies or alter boot settings.
  • Segment the network so a single compromised workstation cannot reach every server and hypervisor.
  • Rehearse the response. CISA's checklist says to isolate affected systems first, using out-of-band channels such as phone calls so attackers don't see that they've been spotted. Power devices down only if you cannot disconnect them, because that destroys evidence in memory. Hunt for precursor malware before restoring, reset credentials only after the environment is clean, and restore from offline backups in order of business priority.
  • Report it. CISA asks victims to report through cisa.gov/report, and the FBI through its Internet Crime Complaint Center or a local field office. For the latest group-specific detail, see ZeroDayFeed's coverage of the SafePay joint advisory.

Sources