Attacks have become shorter and more precise: on average, less than a day passes from initial access to encryption. We break down the chain and the points where it can be broken.
Over the past year, ransomware attacks in the region have changed noticeably. Where weeks used to pass between initial compromise and encryption, attackers now get it done in under a day. Checking the logs once a week no longer works: detection has to be continuous.
The main initial access vector is unchanged: compromised remote access accounts without a second factor and vulnerable exposed services. Second is phishing with attachments that contain no malicious code themselves, only a link to a legitimate file-sharing service. Such emails get past most basic filters.
Once inside, attackers almost always do the same things: dump credentials from memory, look for a domain administrator account and delete backups. Backup deletion is the last point at which the attack can still be stopped without catastrophic losses.
What actually reduces risk: multi-factor authentication on every remote access point, isolated and immutable backups, privileged session control, and 24/7 monitoring with response. Technology without a duty shift only gives you a delayed notification that the data is already lost.