How Ransomware Spreads Through Business Networks

Ransomware is a type of malicious software that encrypts a company’s files and demands payment to unlock them. Understanding how it moves from one computer to another inside a business network is the first step in preventing it. This guide explains the common propagation methods and provides practical steps to map and block those pathways.

What You’ll Need

Basic knowledge of your network layout (e.g., where servers and workstations are)
Access to your firewall and endpoint security console (or a plan to get it)
A list of your critical servers and shared folders
An up-to-date inventory of software and operating systems in use

Step-by-Step

Identify the entry point. Ransomware usually enters via a phishing email attachment, a malicious link, or a compromised remote desktop (RDP) port. Look for the initial infection vector—check email logs for suspicious attachments or failed login attempts on RDP.
Understand the initial foothold. Once the first machine is infected, the malware often runs a script to disable security tools and create scheduled tasks. Look for unexpected processes or scheduled tasks on the affected machine.
Map the network shares. Ransomware scans for open network shares (SMB/CIFS) and mapped drives. Use a network scanner to list all shared folders and their permissions. The malware typically tries to write encrypted copies to any writable share it can reach.
Check for lateral movement via credentials. Many ransomware strains use built-in Windows tools like PsExec, WMI, or PowerShell to move from one machine to another using stolen credentials. Look for unusual remote execution activity in your Windows Event Logs (e.g., Event ID 4624 for successful logins, Event ID 4648 for explicit credentials).
Examine RDP exposure. If any machine has RDP exposed to the internet, that is a prime target. Check your firewall logs for brute-force attempts. If found, that path is likely used to gain access.
Trace the encryption pattern. Ransomware often encrypts files in a specific order: local drives first, then mapped network drives, then any writable shares it can find. Check for the ransom note file (e.g., README.txt or HOW_TO_DECRYPT.html) on multiple machines to see how far it spread.
Isolate and contain. As soon as you confirm an infection, disconnect the affected machine from the network (unplug the cable or disable the Wi-Fi). Then, block the ransomware’s known command-and-control (C2) domains at your DNS or firewall level.
Review backup integrity. Check if your backups are also encrypted. Ransomware often targets backup servers and shadow copies. Verify that your offline backups are intact and not connected to the network.

Common Mistakes

Assuming one infected PC is isolated. Ransomware can spread within minutes. Do not delay containment.
Ignoring RDP logs. Many businesses forget to audit RDP login attempts, leaving the door wide open.
Not segmenting the network. If all machines are on the same flat network, ransomware can reach everything easily.
Disabling alerts. Turning off security warnings to avoid noise can hide the early signs of an attack.
Forgetting about cloud shares. If you sync local folders to OneDrive or SharePoint, ransomware can encrypt those too.

Tips

Enable multi-factor authentication (MFA) on all remote access and admin accounts. This blocks the most common credential theft path.
Use the principle of least privilege. Give users only the file access they need. This limits what ransomware can encrypt.
Patch promptly. Many ransomware variants exploit known vulnerabilities in software like VPNs or web servers.
Test your backups regularly. Do a restore drill to ensure you can recover without paying.
Monitor for unusual behavior. Set alerts for mass file renames or high CPU usage on file servers.

Troubleshooting

If the ransomware still spreads despite your efforts:

Check for hidden admin shares. Even if you removed mapped drives, Windows has default admin shares (C$, ADMIN$). Disable them via the registry if not needed.
Look for new user accounts. Ransomware sometimes creates a local admin account to maintain access. Search for recently created users in the Security log.
Verify that your security software is actually running. Some ransomware disables it. Reinstall or use a standalone scanner.
Check for scheduled tasks on all machines. Use PowerShell to list scheduled tasks remotely and look for suspicious ones.
If you cannot stop it, disconnect the entire subnet. It is better to take a temporary outage than to lose all data.

Frequently Asked Questions

Can ransomware spread without user interaction?

Yes. Some variants, like WannaCry, exploit vulnerabilities in SMBv1 and spread automatically without any user clicking.

Does ransomware always encrypt files on network drives?

Not always, but most modern strains do. They look for any writable drive letter and encrypt files there.

How long does it take for ransomware to spread across a network?

It can be minutes. The faster the malware finds credentials and reaches shares, the quicker it spreads. Some outbreaks have encrypted hundreds of machines in under an hour.

Can ransomware spread through Wi-Fi?

Yes, if the Wi-Fi is part of the same network. It spreads over any network connection, not just Ethernet.

Does paying the ransom guarantee the files will be decrypted?

No. Paying funds criminal activity and often does not result in decryption. It is better to rely on backups and professional recovery tools.

Can ransomware spread to cloud-synced folders?

Yes. If a folder is synced to a cloud service, the encrypted files will be uploaded, and the cloud version may also be encrypted.

Method: the standard formula for this calculation, rounded as each result states. See how the calculators work or report an error.

More cards in this drawer

The whole Numbers and Powers drawer →