A Week Inside a Ransomware Attack

Monday: how the target gets picked

Attackers running a small volume operation work from spreadsheets of prospects, often around 40 a month, favouring businesses with 10 to 50 staff. Large enterprises have security teams and lawyers that make recovery expensive for the attacker. Sole traders rarely have enough at stake to bother with. A business in the middle sits in the right zone: payroll, a customer database, project files, supplier relationships, and an owner who will pay to get it all back.

The target isn't found through a breach or a tip. It's found on public business records: state registries, federal contract awards, and county-level licensing databases publish enough detail to identify the company, estimate revenue, and pick the most useful person inside it. A clean track record, no past incidents, is itself a signal. It suggests credentials are still valid and staff haven't been trained to spot anything unusual.

Thursday: getting past MFA

Multi-factor authentication stops a lot of attacks, but the implementation matters more than the checkbox. Simple push-notification fatigue no longer works against Microsoft 365 accounts, since Microsoft enabled number matching by default for all Authenticator push notifications in May 2023. What still works is adversary-in-the-middle (AiTM) phishing.

A phishing email designed to look like a routine password reset notification, citing the same breach the password was found in, links to a proxy page that mirrors the real Microsoft sign-in screen. When the target enters their password and approves the MFA prompt, the proxy forwards both to the real Microsoft server, captures the resulting session token, and the victim sees a normal "password updated successfully" message. Microsoft sees a valid authenticated session and treats the attacker's activity as legitimate.

A backup plan covers the case where the email isn't clicked: a phone call posing as the company's IT provider, using a name pulled from a Google review, asking a receptionist to approve a verification push. If that fails too, it costs nothing to try again later. Once inside, an inbox forwarding rule is set up quietly, and the attacker waits.

Five places this attack would have died

Five ordinary things weren't in place. None of them were expensive, and most were already bundled into security tools the business was already paying for.

• The credential purchase. HaveIBeenPwned is free, and Microsoft Entra password protection can block reused or commonly compromised passwords. Unique passwords per account, enforced through a password manager and Entra policy, make a stolen credential package useless.
• The MFA bypass. Phishing-resistant MFA (FIDO2 hardware keys, passkeys, or Windows Hello for Business), Conditional Access policies requiring a compliant device, and anti-phishing protection in Microsoft Defender for Office 365 would each have prevented the session token capture or made it unusable.
• The inbox forwarding rule. Microsoft 365 allows admins to block external forwarding rules at the tenant level. With that in place, the attacker never gets to read 36 hours of email.
• The 36-hour dwell time. Microsoft Defender for Business, included in Microsoft 365 Business Premium, alerts on new inbox forwarding rules. Someone reviewing those alerts catches the intrusion on Thursday night.
• The public business records. State and federal registries can't be unpublished, but what a team posts about their specific responsibilities can be. A LinkedIn profile detailing financial duties is worth a conversation about practical security awareness.