Details are altered and the client is anonymised, but the timeline is real. It is worth reading because almost nothing in it is sophisticated.
Day 1: a valid credential
Initial access came through a VPN account belonging to a contractor who had finished their engagement four months earlier. The account was still enabled. It had no second factor because the exemption granted “temporarily” in 2023 had never been reviewed.
There was no exploit. Someone logged in.
Day 2 to 4: quiet enumeration
The operator ran directory enumeration through built-in tooling only. No malware touched disk, so the endpoint agent had nothing to alert on. They mapped the domain, found a service account with local administrator rights across the server estate, and confirmed the backup infrastructure was domain-joined.
That last fact decided the rest of the week.
Day 5: staged exfiltration
Roughly 340 GB moved out over HTTPS to a cloud storage provider the organisation used legitimately. Volume was the only anomaly, and nobody was watching egress volume per host.
This is the half of the extortion that survives a good backup. Restoring your files does not un-publish them.
Day 6: backups first
The backup catalogue was encrypted before anything else. Then the file servers, then the hypervisors. The operator scheduled it for a Saturday at 02:14.
Day 7: the note
By the time the on-call engineer understood the scale, the negotiation window had already been framed by the attacker: pay for the decryptor, and pay again for the deletion of what was taken.
What would have broken the chain
Three controls, none of them expensive. A quarterly review that disables dormant accounts. Backup infrastructure kept off the production domain, with credentials that do not exist in Active Directory. An egress-volume baseline per host, alerting on deviation.
The organisations that survive this are rarely the ones with the largest security budget. They are the ones that closed the boring gaps.