How does ransomware work?

A typical attack moves through stages: initial access (often via phishing, stolen credentials, or an exploited vulnerability), establishing persistence, escalating privileges, moving laterally, exfiltrating data, and finally deploying the encryption payload. Attackers frequently dwell undetected for days or weeks before triggering encryption.

That dwell time is why recovery is so dangerous: backups taken during this period can already contain the threat. Elastio hunts continuously across recovery points so it can identify the clean boundary — the point in time before the attacker was present.

Last updated May 27, 2026