Ransomware Q1 Attack Paths: From Initial Access to Lateral Movement

Starting With Three Compromised Clients

In Q1 this year we handled three ransomware incidents: one came through RDP brute-forcing, one through a phishing email, and one where a backdoor was planted during a vendor’s remote maintenance session. The attack paths in all three cases line up almost perfectly into a textbook intrusion chain. In the post-incident reviews, every client asked the same question: “Our firewall was clearly on — how did they get in?” The answer is usually that the attackers never used the front door. They came in through a side door.

This is not alarmism. According to the attack logs we monitor, 78% of the initial access in ransomware attacks against Beijing-area enterprises in Q1 came through three routine entry points: an exposed RDP port 3389, email phishing, and supply chain compromise through partners. These three paths account for nearly every scenario in which an SMB gets hit by ransomware. Below I break the attack chain down stage by stage, with de-identified analysis drawn from real cases.

Stage One: Initial Access — Three Keys, One Lock

An attacker’s first step is always to get a ticket in. They are not picky — whichever key works is the one they use.

RDP brute-forcing is the most common key. Last year at a trading company, the IT administrator took a shortcut and mapped the finance server’s port 3389 straight to the public internet, with the password set to “Admin123!”. The attacker ran a dictionary script for three days and got in. That night the attacker did not act immediately; instead they spent two weeks mapping out the company’s AD architecture, backup strategy, and even the administrator account for the finance software. The actual encryption began at nine o’clock on a Friday night — by the time IT came in the next morning, all eighteen servers had been hit.

Phishing email is another master key. In a case we handled this February, the attacker posed as SF Express and sent a phishing email with an archive attached, containing what looked like an ordinary PDF icon. After the employee double-clicked, an HTA script pulled down Cobalt Strike in the background; PowerShell executed filelessly, straight from memory. By the time the security software caught on, lateral movement was already half finished.

Supply chain compromise is the hardest key to defend against, because it does not attack you — it attacks your service provider. One manufacturing client was breached for an absurd reason: the outsourcing firm handling their ERP implementation used a weak-password VPN for remote maintenance, and the attacker rode that connection straight into the client’s internal network. It is like having a solid steel front door while the neighbor loses their key — the thief still gets in.

Stage Two: Lateral Movement — From One Machine to a Network-Wide Collapse

Once they have an initial foothold, attackers are not satisfied with a single machine. Their aim is to expand that foothold until they control the whole network.

Common lateral movement techniques include Pass-the-Hash, credential harvesting with Mimikatz, NTLM relay, and exploitation of legacy internal vulnerabilities such as MS17-010. Once the attacker obtains administrator credentials on any machine inside the network, they use Cobalt Strike or similar tools to scan for live hosts at scale. We have observed that the machines ransomware gangs prefer to hit first are: domain controllers, backup servers, VMware vCenter, and any file server with shared storage attached. That is no surprise — controlling these first delivers the best encryption coverage and maximizes the ransom payoff.

During lateral movement, attackers also do one more thing: they turn off security software. They use PsExec to run commands remotely, or load malicious processes directly into memory to evade antivirus behavior detection. In one incident, the client had a well-known antivirus product installed, but the attacker pushed a policy through GPO that disabled it across the board — because the domain administrator password had leaked, giving the attacker domain controller privileges outright.

The entire lateral movement phase usually completes within 48 to 72 hours, but attackers often deliberately slow the pace and mimic normal administrator behavior — working only during business hours, clearing logs, and doing reconnaissance with low-privilege accounts first. This defeats many threshold-based alerting systems entirely.

Defensive Priorities: Six Steps to Break the Attack Chain

Knowing the attack path does not mean you can stop it. In practice, we recommend addressing things in the following order of priority:

1. Eliminate direct RDP exposure. Take port 3389 off the public internet and replace it with a VPN or Siwenlide’s zero trust access solution. If you genuinely need RDP, enable Network Level Authentication (NLA) plus two-factor authentication.
2. Email security cannot rely on spam filtering alone. Deploy attachment sandboxing at the email gateway and block script attachments such as HTA, JS, and VBS outright.
3. Supply chain security requires its own audit. Create separate accounts for every third-party remote connection, route them through a jump server, and record and audit all sessions. We ran a full vendor access audit for a manufacturing client and found that 34% of remote accounts had never had their password changed.
4. Segment the internal network. Production, office, and guest networks must be physically or logically isolated. Do not install unnecessary software on domain controllers, and never open port 445 to machines that do not need it.
5. Bring privileged accounts under management. Route all domain admin, backup admin, and database DBA passwords through PAM (Privileged Access Management), rotate them regularly, and never reuse the same credentials.
6. Offline backups are the last line of defense. Follow the 3-2-1 rule: at least three copies, two types of media, one stored offline. Ransomware deletes shadow copies first, so a physically isolated backup medium is what actually keeps you alive.

If you have not run an internal penetration test yet, schedule one as soon as possible. We just finished testing a factory in Shunyi and found 23 legacy servers running SMBv1 on day one — hitting MS17-010 would have cut straight across the entire shop-floor network. The number of vulnerabilities is not what you should fear; not knowing where they are is.