Ransomware Attack Sequence
Typical ransomware intrusion from initial access to extortion.
Rendering…
Make it your own.
sequenceDiagram
participant Att as Attacker
participant U as User (victim)
participant W as Workstation
participant AD as Domain Controller
participant F as File servers
participant ER as External relay
Att->>U: Phishing email + macro doc
U->>W: Opens doc — loader runs
W->>ER: Beacon C2 (HTTPS)
ER-->>W: Cobalt-Strike implant
W->>AD: Kerberoast / DCSync
AD-->>W: Hashes / TGT
W->>F: Lateral move (SMB)
F-->>W: Read access
W->>F: Encrypt + drop ransom note
W->>ER: Exfil sensitive data
Att-->>U: Double-extortion demand