Ransomware in 2026: Modern Tactics and the First 72 Hours

The common entry points have been stable for years: valid credentials bought or phished, an internet-facing service missing a patch, and remote access exposed without multi-factor authentication. None of these require sophisticated malware.

This is where detection is still cheap. Watch for shadow copies being deleted, backup agents stopped, new administrative accounts, mass file reads by a single account, archiving tools appearing on servers, and large outbound transfers to file-sharing services at unusual hours.

Hours zero to four are about containment and evidence at the same time: isolate affected hosts at the network level rather than powering them off, preserve memory and logs, and disable the compromised accounts. Powering a machine off destroys evidence that determines whether data was stolen.

Hours four to twenty-four are for scope: which accounts, which systems, what was accessed, and whether backups are intact and offline. Hours twenty-four to seventy-two are for decisions — recovery sequencing, regulatory notification, customer communication and legal counsel.

Attackers target backup infrastructure deliberately and often first. At least one copy must be immutable or physically offline, restoration must be tested on a schedule against a realistic recovery time objective, and backup administration should require separate credentials from domain administration.