# How a ransomware attack unfolds

> A process map exported from forks.world (https://forks.world). Author: Brian. Source: https://forks.world/p/cmv21nrje001ll2064f1dce3z
> It describes who does what, in what order, and with which technology. Read the plain-language sections first; the JSON at the end is the exact, complete data.

## Summary

- 12 steps across 1 layer
- Persona: Attackers, An employee, IT and security team, The company leadership

## Pain points

Where this process hurts, worst first:

- **Clicks the link or opens the file** (How a ransomware attack unfolds; critical): One click is all it takes

## How to read this file

- A process is made of **layers**. The main layer is the top level; any step of kind `subprocess` opens a detail layer with its own lanes and steps.
- **Lanes** are either persona (people/roles) or technology (systems). Each step belongs to one lane; `using` lists tools a person uses for that step.
- Step kinds: `start`, `task`, `decision` (its arrows carry the answer as a label), `subprocess`, `end`.

## How a ransomware attack unfolds

Lanes:
- Attackers: person / role (id `crim`)
- An employee: person / role (id `emp`)
- IT and security team: person / role (id `it`)
- The company leadership: person / role (id `co`)

Steps, in the order they run:

1. **Send a convincing phishing email** [start; Attackers; id `r1`]
   - then Clicks the link or opens the file
2. **Clicks the link or opens the file** [task; An employee; id `r2`] ⚠ PAIN POINT (critical): One click is all it takes
   - then Malware installs and steals passwords
3. **Malware installs and steals passwords** [subprocess; Attackers; id `r3`], links to the published process "How a data breach happens" (https://forks.world/p/cmv0kpyxo0013jv06kwcl1g5d; full text at https://forks.world/api/public/cmv0kpyxo0013jv06kwcl1g5d/export)
   - then Moves quietly through the network for days or weeks
4. **Moves quietly through the network for days or weeks** [task; Attackers; id `r4`]
   - then Copies sensitive files for a second threat
5. **Copies sensitive files for a second threat** [task; Attackers; id `r5`]
   - then Encrypts files on many computers at once
6. **Encrypts files on many computers at once** [task; Attackers; id `r6`]
   - then Spots the lockout and cuts off the network
7. **Spots the lockout and cuts off the network** [task; IT and security team; id `r7`]
   - then Are there clean, tested backups?
8. **Are there clean, tested backups?** [decision; The company leadership; id `r8`]
   - if "Yes" go to Rebuild from backups; if "No" go to Decide whether to pay, with no guarantee the files return
9. **Rebuild from backups** [task; IT and security team; id `r9`]
   - then Report it, investigate and fix the weak points
10. **Report it, investigate and fix the weak points** [subprocess; The company leadership; id `r12`], links to the published process "Respond to an incident" (https://forks.world/p/cmv0iedbx004kjw060iqtrof5; full text at https://forks.world/api/public/cmv0iedbx004kjw060iqtrof5/export)
   - (no next step recorded)
11. **Decide whether to pay, with no guarantee the files return** [task; The company leadership; id `r10`]
   - then Threaten to leak the stolen files
12. **Threaten to leak the stolen files** [task; Attackers; id `r11`]
   - then Report it, investigate and fix the weak points

```mermaid
flowchart LR
  subgraph l_crim["Attackers"]
    n_r1(["Send a convincing phishing email"])
    n_r3[["Malware installs and steals passwords"]]
    n_r4["Moves quietly through the network for days or weeks"]
    n_r5["Copies sensitive files for a second threat"]
    n_r6["Encrypts files on many computers at once"]
    n_r11["Threaten to leak the stolen files"]
  end
  subgraph l_emp["An employee"]
    n_r2["Clicks the link or opens the file"]
  end
  subgraph l_it["IT and security team"]
    n_r7["Spots the lockout and cuts off the network"]
    n_r9["Rebuild from backups"]
  end
  subgraph l_co["The company leadership"]
    n_r8{"Are there clean, tested backups?"}
    n_r10["Decide whether to pay, with no guarantee the files return"]
    n_r12[["Report it, investigate and fix the weak points"]]
  end
  n_r1 --> n_r2
  n_r2 --> n_r3
  n_r3 --> n_r4
  n_r4 --> n_r5
  n_r5 --> n_r6
  n_r6 --> n_r7
  n_r7 --> n_r8
  n_r8 -->|"Yes"| n_r9
  n_r8 -->|"No"| n_r10
  n_r9 --> n_r12
  n_r10 --> n_r11
  n_r11 --> n_r12
```

## Full data (JSON)

```json
{
  "title": "How a ransomware attack unfolds",
  "maps": {
    "m_root": {
      "id": "m_root",
      "lanes": [
        {
          "id": "crim",
          "name": "Attackers",
          "type": "person"
        },
        {
          "id": "emp",
          "name": "An employee",
          "type": "person"
        },
        {
          "id": "it",
          "name": "IT and security team",
          "type": "person"
        },
        {
          "id": "co",
          "name": "The company leadership",
          "type": "person"
        }
      ],
      "steps": [
        {
          "id": "r1",
          "kind": "start",
          "lane": "crim",
          "next": [
            {
              "to": "r2"
            }
          ],
          "uses": [],
          "label": "Send a convincing phishing email"
        },
        {
          "id": "r2",
          "kind": "task",
          "lane": "emp",
          "next": [
            {
              "to": "r3"
            }
          ],
          "pain": {
            "note": "One click is all it takes",
            "level": 3
          },
          "uses": [],
          "label": "Clicks the link or opens the file"
        },
        {
          "id": "r3",
          "kind": "subprocess",
          "lane": "crim",
          "link": {
            "id": "cmv0kpyxo0013jv06kwcl1g5d",
            "scope": "public",
            "title": "How a data breach happens"
          },
          "next": [
            {
              "to": "r4"
            }
          ],
          "uses": [],
          "label": "Malware installs and steals passwords"
        },
        {
          "id": "r4",
          "kind": "task",
          "lane": "crim",
          "next": [
            {
              "to": "r5"
            }
          ],
          "uses": [],
          "label": "Moves quietly through the network for days or weeks"
        },
        {
          "id": "r5",
          "kind": "task",
          "lane": "crim",
          "next": [
            {
              "to": "r6"
            }
          ],
          "uses": [],
          "label": "Copies sensitive files for a second threat"
        },
        {
          "id": "r6",
          "kind": "task",
          "lane": "crim",
          "next": [
            {
              "to": "r7"
            }
          ],
          "uses": [],
          "label": "Encrypts files on many computers at once"
        },
        {
          "id": "r7",
          "kind": "task",
          "lane": "it",
          "next": [
            {
              "to": "r8"
            }
          ],
          "uses": [],
          "label": "Spots the lockout and cuts off the network"
        },
        {
          "id": "r8",
          "kind": "decision",
          "lane": "co",
          "next": [
            {
              "to": "r9",
              "label": "Yes"
            },
            {
              "to": "r10",
              "label": "No"
            }
          ],
          "uses": [],
          "label": "Are there clean, tested backups?"
        },
        {
          "id": "r9",
          "kind": "task",
          "lane": "it",
          "next": [
            {
              "to": "r12"
            }
          ],
          "uses": [],
          "label": "Rebuild from backups"
        },
        {
          "id": "r10",
          "kind": "task",
          "lane": "co",
          "next": [
            {
              "to": "r11"
            }
          ],
          "uses": [],
          "label": "Decide whether to pay, with no guarantee the files return"
        },
        {
          "id": "r11",
          "kind": "task",
          "lane": "crim",
          "next": [
            {
              "to": "r12"
            }
          ],
          "uses": [],
          "label": "Threaten to leak the stolen files"
        },
        {
          "id": "r12",
          "kind": "subprocess",
          "lane": "co",
          "link": {
            "id": "cmv0iedbx004kjw060iqtrof5",
            "scope": "public",
            "title": "Respond to an incident"
          },
          "next": [],
          "uses": [],
          "label": "Report it, investigate and fix the weak points"
        }
      ],
      "title": "How a ransomware attack unfolds",
      "parent": null
    }
  }
}
```