Anatomy of a Targeted Ransomware Attack

Ransomware — malicious software that encrypts files until a ransom is paid — has evolved from a scattershot nuisance into a precision weapon. A related threat, ransom DDoS (RDDoS), takes a different tack: attackers flood your network with traffic and demand payment to stop. Cloudflare recently helped a Fortune 500 customer fend off such an extortion attempt. Drawing on experience responding to ransomware incidents across healthcare, financial, and education sectors, here is how these targeted intrusions unfold and where defenses hold up.

Attacks fall into two broad categories. Opportunistic campaigns cast a wide net: mass spam emails with malicious links or attachments, drive-by downloads, and malvertising chains aim to infect any vulnerable endpoint with ransomware. Targeted attacks, by contrast, are surgical — they focus on compromising critical systems, exfiltrating data, and planting backdoors, all to extract a much larger Bitcoin payment.

Entry Points

In investigations of targeted ransomware, three initial vectors dominate:

  • Compromised Remote Desktop Protocol (RDP) or Virtual Private Network (VPN) servers
  • Exploited unpatched vulnerabilities in web applications or servers
  • Spear-phishing of specific individuals to gain a foothold

RDP and VPN compromises were by far the most common. In most cases these were not sophisticated operations — attackers scanned the internet for RDP servers listening on the default port 3389 and attempted brute-force logins, often succeeding where two-factor authentication was not enforced. In other instances, stolen credentials granted access over VPN. Cloudflare Access can shield RDP servers from these attacks, and Magic WAN & Firewall adds segmentation control over internal resources. Where attackers exploit a software vulnerability and no patch exists yet, a web application firewall such as Cloudflare's WAF provides short-term mitigation to block exploitation attempts.

Inside the Network: Recon, Persistence, and Destruction

One particularly revealing incident shows how far attackers will go. After breaching an RDP server, the attacker performed internal reconnaissance to map out critical systems. Using compromised credentials, they remotely installed backdoors on two key systems to maintain persistence — an uncommon move in ransomware cases that signals elevated effort. Then came the truly damaging step: the attacker moved laterally to the internal backup servers and permanently deleted all data backups, leaving the organization without an offsite copy to restore from.

The attacker also exfiltrated sensitive customer data before deploying the ransomware across the environment, bringing operations to a complete halt. Afterward, they contacted board members and key decision makers directly by email, demanding a large Bitcoin payment in exchange for decryption keys — and threatening to release the stolen customer data if the ransom was not paid, supplying proof as leverage.

Defensive Layers

Defenders have multiple opportunities to detect an intrusion, even if attackers only need a single way in. Malware scanning in Cloudflare Gateway adds a critical early-warning capability: it can detect malicious files that unsuspecting users download or that an attacker places on a system. Gateway also blocks malicious domains to prevent other users from reaching them, and its logs help investigators scope which devices may be compromised by identifying those communicating with known-bad domains. Cloudflare's own security team uses Gateway this way for user protection and investigations.

Combined with Gateway, Cloudflare Access and the WAF add security and visibility across users and applications. Access lets you control which users can reach which resources, monitor authentication activity, and revoke access quickly when compromise is suspected. Internet-facing web applications should sit behind a WAF to filter malicious traffic — one unpatched vulnerability is all it takes for an attacker to gain entry or embed malicious content.

Ransom is not only an endpoint problem. Attackers can also use botnets to hit your network with ransom DDoS attacks. For that reason, dedicated DDoS mitigation is a necessary part of any defense posture.

Practical Recommendations

  • Enable two-factor authentication everywhere, especially on remote access entry points — Cloudflare Access helps enforce this.
  • Keep multiple redundant backups of critical systems and data, both onsite and offsite.
  • Monitor and block malicious domains using Cloudflare Gateway with malware scanning.
  • Sandbox web browsing with Cloudflare Remote Browser Isolation (RBI) to contain threats at the browser layer.