They paid on a Wednesday. $12,000 in Bitcoin, sent to an address in the ransom note. The decryption key came through. Files were restored. They were back up by Friday.

Two weeks later, the ransom demand arrived again.

The attackers had never left. Paying the ransom had bought them a decryption key, not a clean network. The same group — or a buyer they'd sold access to — was still inside, sitting in a persistent backdoor they'd installed during the weeks they spent in the environment before triggering the encryption.

The second demand was for $18,000. This time they called an incident response firm instead.

How a modern ransomware attack actually works

The popular conception of ransomware — someone clicks a link, files get encrypted, ransom note appears — describes only the final act of a much longer attack.

Modern ransomware groups (often called Ransomware-as-a-Service operators) work like this:

  1. Initial access: Through a phishing email, an exploited VPN vulnerability, or compromised credentials purchased from another attacker, they gain a foothold in the network. This is often quiet and fast.
  2. Persistence and reconnaissance: They move laterally through the network, escalate privileges, identify what's valuable, and install persistence mechanisms (backdoors, modified remote access tools). This phase typically takes days to weeks.
  3. Data exfiltration: Before encrypting anything, they exfiltrate a copy of your sensitive files. This enables a second extortion threat: "Pay or we publish your client data."
  4. Encryption: Only now do they trigger the ransomware payload across the network.

Paying the ransom addresses step 4. Steps 1–3 remain intact unless you actively hunt and remediate them.

Why 60% of victims get hit again

The same initial access vector that let them in the first time is often still exploitable. The persistence mechanisms they installed are still running. The compromised credentials they used are still valid.

Some groups sell access to environments they've established persistence in. After receiving the ransom, they sell the existing access to another group. The victim assumes they're clean. They're not.

The only way to know you're clean after a ransomware attack is a full incident response investigation: forensic analysis of every compromised system, identification and removal of all persistence mechanisms, credential reset for every account in scope, and confirmation that the initial entry vector is closed.

What a ransomware response plan covers

A response plan exists so that when ransomware hits, you're executing a documented process rather than improvising under pressure.

Phase 1: Containment (first hours)

  • Isolate affected systems from the network — do not power them off (you'll lose forensic evidence in volatile memory)
  • Identify the scope of the incident: which systems are encrypted, which appear unaffected
  • Take systems offline in a controlled way — disconnect from network, not from power
  • Contact your IT provider or incident response firm immediately

Phase 2: Assessment (first 24 hours)

  • Identify the ransomware variant — this determines whether decryption without paying is possible
  • Determine the scope of data exfiltration: what was accessed before encryption?
  • Assess backup status: are backups clean? Are they offline and not affected by the encryption?
  • Assess legal obligations: under PIPEDA, you may have breach notification obligations

Phase 3: Recovery

  • Restore from clean backups — not backup copies that were on the network during the attack
  • Complete forensic investigation to identify and remove all persistence mechanisms
  • Reset all credentials — every account, not just the obvious ones
  • Close the initial entry vector before reconnecting systems
  • Confirm no data exfiltration of regulated information before deciding not to notify

The backup question

Most businesses realize during a ransomware incident that their backups were either insufficient, corrupted by the attack, or hadn't been tested. The backup you're counting on should be:

  • Offline or immutable — attackers frequently target and encrypt backup systems before triggering the main ransomware payload
  • Tested regularly — an untested backup is not a backup, it's a hope
  • Recent enough — a backup from two weeks ago means two weeks of data loss

The 3-2-1 rule: three copies, on two different media types, with one offsite (ideally offline or immutable cloud storage).