Full Report
During ransomware attacks, the average time-to-ransom for attackers is almost 17 hours. Learn more about what this means for businesses.
Analysis Summary
# Incident Report: The "17-Hour Window" – Analyzing Time-to-Ransom Trends
## Executive Summary
Recent threat intelligence indicates the average "time-to-ransom" (TTR) is approximately 17 hours, with some groups like Play and Akira moving from initial access to encryption in as little as 4 hours. Attackers typically perform 18 distinct malicious actions—such as privilege escalation and log clearing—before deploying the payload. The study emphasizes that rapid detection is critical, as data exfiltration almost always occurs immediately preceding the final encryption phase.
## Incident Details
- **Discovery Date:** Analysis published May 13, 2025 (Based on data from late 2023–2024)
- **Incident Date:** Ongoing trend analysis
- **Affected Organization:** Multiple (Aggregated Huntress customer data)
- **Sector:** Cross-sector (SMB focus)
- **Geography:** Global
## Timeline of Events
### Initial Access
- **Date/Time:** T-Minus 17 hours (Average)
- **Vector:** RDP Brute Force and Stolen Credentials
- **Details:** Attackers gain entry through poorly secured remote access points or compromised identities.
### Lateral Movement
- **Hours 1–16:** Attackers move through the network to identify high-value targets, backups, and security infrastructure. Groups like Phobos and Maze are noted for higher activity volumes (30+ actions) during this phase.
### Data Exfiltration/Impact
- **Final Hour:** Data exfiltration typically occurs as the final step immediately before the ransomware payload is triggered to maximize extortion leverage.
### Detection & Response
- **Discovery:** Identified through unauthorized account access logs and EDR alerts.
- **Response Actions Taken:** Managed EDR interventions, SOC-led investigations, and host isolation.
## Attack Methodology
- **Initial Access:** RDP Brute Force, Stolen Credentials.
- **Persistence:** Unauthorized account creation and persistence via remote access tools.
- **Privilege Escalation:** Commands used to gain administrative control (observed in high-activity groups like Maze).
- **Defense Evasion:** Clearing event logs, disabling security tools, and targeting local backups.
- **Credential Access:** Credential harvesting from memory or disk.
- **Discovery:** Scanning the environment to map the network and locate sensitive data.
- **Lateral Movement:** Moving between systems to expand the scope of compromise.
- **Collection:** Aggregating sensitive files for theft.
- **Exfiltration:** Transferring data to attacker-controlled infrastructure (Double Extortion).
- **Impact:** Deployment of ransomware payloads (e.g., Play, Akira, RansomHub, Black Basta).
## Impact Assessment
- **Financial:** High (Ransom demands + business downtime costs).
- **Data Breach:** High (Exfiltration is a standard precursor to encryption).
- **Operational:** Severe disruption due to system encryption.
- **Reputational:** High risk due to the use of public data leak sites.
## Indicators of Compromise
- **Network indicators:** Connections to known Ransomware-as-a-Service (RaaS) C2 infrastructure (e.g., associated with Play or Akira domains).
- **File indicators:** `.ransomware` extensions, ransom notes (e.g., `README.txt`), and malicious binaries.
- **Behavioral indicators:** Mass deletion of shadow copies, rapid sequence of log-clearing commands, and sudden spikes in outbound data traffic.
## Response Actions
- **Containment measures:** Immediate isolation of compromised hosts via EDR.
- **Eradication steps:** Termination of malicious processes, removal of persistence mechanisms, and account resets.
- **Recovery actions:** Restoring from offline/immutable backups after the environment is cleared.
## Lessons Learned
- **The "4-Hour Floor":** While the average is 17 hours, defenders must be prepared to respond within a 4-hour window for elite groups.
- **Exfiltration is the Signal:** A spike in data movement is often the "final warning" before total system lockout.
- **Complexity Varies:** A low number of actions doesn't mean a low threat; it often indicates a highly efficient, targeted "smash and grab" attack.
## Recommendations
- **MFA Enforcement:** Mandatory Multi-Factor Authentication for all RDP and external-facing accounts.
- **Backup Hardening:** Ensure backups are air-gapped or immutable to prevent attackers from disabling them.
- **Aggressive Monitoring:** Implement managed EDR with a target MTTR (Mean Time to Respond) of under 15 minutes to beat the 4-hour attack window.
- **Log Protection:** Ship logs to a central, secure repository that attackers cannot easily clear.