After the door opens

Summary

Ransomware is a sequence of steps that starts at the VPN door and often ends, days later, with encryption. By the time screens go dark, the intruder usually holds the master keys, has deleted the backups and has copied data out.

The logs each step leaves

Each step leaves a record in a log most companies already have: the VPN appliance, Active Directory, the file server, the backup software.

Step 2: a login that does not fit the person

To the appliance, this is a normal login with a valid account.

2What the IT team would seeTime T+0

• VPN logA successful login at 03:00 by an account whose owner is asleep, from an address outside Japan or at a hosting provider.
• VPN logA run of failed logins just before it, or none at all if the password had leaked.
• VPN logA login on an account that should not exist any more: a former employee, or a contractor whose contract has ended.

Step 3: one remote worker touches dozens of machines

The intruder now has an inside address and starts mapping the network. Nothing passed through email filtering or antivirus, so they record nothing.

3What the IT team would seeTime within 5 minutes

• firewallOne VPN session connecting to dozens of internal addresses within minutes.
• serversRemote desktop attempts to many servers from one machine. In the Osaka hospital case, information on about 240 addresses was collected and remote desktop tried to about 70 from one server.

Source: Arctic Wolf Smash and Grab: Aggressive Akira Campaign Targets SonicWall VPNs, Deploys Ransomware in an Hour or Less; Osaka General Medical Center, Information Security Incident Investigation Committee 「調査報告書」 (pp.11–12, 18–19, 36–41, 45–47; pp.11, 37, 45–46, 71)

Arctic Wolf saw Akira operators start scanning the internal network “within five minutes” of logging in to a SonicWall VPN.

Step 4: a new administrator appears

The intruder takes over or creates an administrator account in Active Directory.

4What the IT team would seeTime median 3.40 h

• ADA user account nobody requested, or an existing account added to the Domain Admins group.
• ADAn administrator account logging on from a VPN address.
• serversAntivirus removed or switched off on a server. In Osaka it was uninstalled from the first server the intruder reached.

Source: Sophos Nowhere, man: The 2026 Active Adversary Report (2025 case data); Osaka General Medical Center, Information Security Incident Investigation Committee 「調査報告書」 (pp.11–12, 18–19, 36–41, 45–47; pp.11, 37, 45–46, 71)

In Sophos’s 2025 case data, the median time from gaining access to the first attempt on Active Directory was 3.40 hours.

Step 5: backup jobs start failing

This usually happens in the last hours or days before encryption.

5What the IT team would seeTime before encryption

• backupBackup jobs fail, or the backup server stops answering.
• backupSomeone logs in to the backup console at night.
• serversShadow copies, the restore points Windows keeps on each server, disappear.

Step 6: one account reads everything

Data is usually copied out days into the attack.

6What the IT team would seeTime median 3 days

• file serverOne account reading thousands of files in a short time.
• serversLarge compressed archives appearing on a server.
• firewallOutbound traffic far above normal, often to a cloud storage service.

Source: Sophos It takes two: The 2025 Sophos Active Adversary Report (2024 case data); Sophos Nowhere, man: The 2026 Active Adversary Report (2025 case data); CISA, FBI and partners #StopRansomware: Akira Ransomware (AA24-109A)

CISA reports one Akira case that took “just over two hours”. In Sophos’s 2024 data the attack was detected a median of 2.7 hours after exfiltration.

Step 7: every file changes its name at once

Encryption is the first step anyone notices without reading a log.

7What the IT team would seeTime under 4 h, sometimes 55 min

• file serverThousands of files renamed with a new extension within minutes. The Osaka files ended in .elbie.
• printersRansom notes printing on every printer, as at Handa Hospital before dawn.
• serversServers and virtual machines stopping.

Source: Arctic Wolf Smash and Grab: Aggressive Akira Campaign Targets SonicWall VPNs, Deploys Ransomware in an Hour or Less; Osaka General Medical Center, Information Security Incident Investigation Committee 「調査報告書」 (pp.11–12, 18–19, 36–41, 45–47; pp.11, 37, 45–46, 71); Tsurugi Town Handa Hospital, expert panel on the computer virus incident 「徳島県つるぎ町立半田病院 コンピュータウイルス感染事案 有識者会議調査報告書」 (printed pp.6–7, 13, 16, 21–22; pp.6–9, 13, 21, 37–38)

Time from entry to encryption

In the fastest cases, VPN login to encryption takes a few hours. The medians for data theft run to days. Each source starts its clock at a different point.

Source: Arctic Wolf Smash and Grab: Aggressive Akira Campaign Targets SonicWall VPNs, Deploys Ransomware in an Hour or Less; Sophos Nowhere, man: The 2026 Active Adversary Report (2025 case data); Tsurugi Town Handa Hospital, expert panel on the computer virus incident 「徳島県つるぎ町立半田病院 コンピュータウイルス感染事案 有識者会議調査報告書」 (printed pp.6–7, 13, 16, 21–22; pp.6–9, 13, 21, 37–38); Sophos It takes two: The 2025 Sophos Active Adversary Report (2024 case data)

Data

Source	Hour 0	Event	Hours
Akira via SonicWall SSL-VPN (Arctic Wolf, 2025)	0 = VPN login	5 min, internal scanning starts	0.08
Akira via SonicWall SSL-VPN (Arctic Wolf, 2025)	0 = VPN login	55 min, ransomware, fastest cases	0.92
Akira via SonicWall SSL-VPN (Arctic Wolf, 2025)	0 = VPN login	under 4 h, encryption, almost all cases	4.00
Sophos incident cases, medians	0 = start of the attack	3.40 h, first attempt on, Active Directory	3.40
Sophos incident cases, medians	0 = start of the attack	11 h in 2024 data	11.00
Sophos incident cases, medians	0 = start of the attack	78.83 h (2025), 72.98 h (2024), data exfiltration	78.83
Handa Hospital, 2021 (expert panel report)	0 = 23:57, first recorded remote desktop activity	03:04, ransom note opened	3.12
Sophos	—	Ransomware deployed outside business hours (Sophos, 2025 data)	88.10%

Osaka General Medical Center, 2022

Osaka General Medical Center (大阪急性期・総合医療センター) was hit in October 2022, and its investigation committee published what happened, with page numbers. The report names the companies only by letter (E社, C社) and does not name the VPN product; it does name the vulnerability.

Step	What the report says	Page
1	The hospital noticed an electronic medical record failure at 07:45 on Monday 31 October 2022. Ransomware was confirmed at about 08:30.	11
2	The hospital’s catering contractor (E社) had a VPN appliance for remote maintenance. It carried CVE-2018-13379, and its global IP address, ID and password were on a publicly posted list. The committee finds it reasonable that the intruder logged in with those credentials.	45
2	The appliance’s firmware had never been updated. Before the emergency upgrade it was found to run version 5.4.2.	18, 37
3	Inside the contractor’s network, the intruder used a dictionary attack tool over remote desktop. The contractor’s PCs shared one weak built-in Administrator password that was in the tool’s list.	45
3	At the request of the catering system builder (C社), the hospital firewall allowed remote desktop from the contractor’s network at all times. The report later found this access was not needed and not in use.	18, 39, 46
4	The password of the first hospital server (server B) was cracked with Mimikatz. The intruder logged in over remote desktop and uninstalled the antivirus software.	12, 45–46
4	The hospital servers shared the same built-in Administrator password, which made lateral movement easy. No account lockout was configured.	12, 19, 46
4	The intruder collected information on about 240 reachable IP addresses and tried remote desktop to about 70 from server B.	47
5	The on-site LTO backup device was encrypted. The critical-care systems had online backups only and could not use them. Off-site LTO tapes were readable and restored the records to their state of 27 October.	38, 40–41
6	No large transfer was seen. The largest were about 1.8 MB over remote desktop and 7.9 MB over SMB, whose content could not be determined because detailed logging was off. The committee judges a leak “extremely unlikely”.	12, 46
7	Most servers, including the medical record servers, were encrypted by the Elbie ransomware. Core systems restarted on day 43 and all clinical systems on day 73.	11
After	C社 upgraded the VPN appliance firmware on the evening of 31 October without a backup, and the VPN syslog was lost. The committee could not determine whether the attack was a single event. Firewall logs showed remote desktop traffic from the contractor back to April 2022, and failed logons before 31 October.	37, 39, 46

Source: Osaka General Medical Center, Information Security Incident Investigation Committee 「調査報告書」 (pp.11–12, 18–19, 36–41, 45–47; pp.11, 37, 45–46, 71)

Steps 5 and 6 differ from the composite. The off-site tapes held, so the main records could be restored, and no data left in any volume the logs could show.

Handa Hospital, 2021

Tsurugi Town Handa Hospital (つるぎ町立半田病院) was hit in October 2021 through the same vulnerability. Page numbers are the printed ones.

Step	What the report says	Page
2	A Fortinet FortiGate 60E VPN appliance for remote maintenance had not been updated since installation, leaving CVE-2018-13379 open.	main 16
2	The leaked data from about 87,000 devices contained the hospital’s global IP address, ID and password. The appliance accepted connections from any address on the internet.	tech 10, 11
3	Remote desktop activity was recorded at 23:57 on 30 October, before the incident was found.	main 21
4	Active Directory allowed 5-character passwords and had lockout disabled. The built-in Administrator account was common to every computer. Mimikatz and PsExec were noted.	tech 9, 15; main 22
5	The backup server’s data from 2018 onward had been physically deleted. Backups kept offline up to 2018 were unaffected and used for recovery.	main 13, 22
7	Before dawn on 31 October, several printers printed the ransom note. At 03:04 a ransom note was opened. 40 computers were affected. Normal care resumed on 4 January 2022.	main 6, 7, 21, 22
After	The vendor updated the VPN appliance’s firmware without preserving logs, so the logs could not be analyzed. Without logs and evidence, the entry route and the lateral movement method remain unknown.	main 16; tech 14

Source: Tsurugi Town Handa Hospital, expert panel on the computer virus incident 「徳島県つるぎ町立半田病院 コンピュータウイルス感染事案 有識者会議調査報告書」 (printed pp.6–7, 13, 16, 21–22; pp.6–9, 13, 21, 37–38); Tsurugi Town Handa Hospital, expert panel on the computer virus incident 「徳島県つるぎ町立半田病院 コンピュータウイルス感染事案 有識者会議調査報告書 技術編」 (printed pp.9–11, 14–15; pp.10–14)

At both hospitals the VPN logs were lost when the appliance was upgraded before anyone copied them.

ATT&CK techniques and the logs that show them

Technique IDs and names are from MITRE ATT&CK. Most Security log events need the matching audit policy enabled. Appliance logs are lost in an upgrade unless they were sent off the box first.

Step	ATT&CK technique	Log or telemetry that shows it	Event IDs
2	T1190 Exploit Public-Facing Application	Often no login record at all, because the flaw is reached before authentication. Look for VPN process crashes and restarts, files on the appliance that should not be there, and configuration changes nobody made. Compare with the vendor's external integrity check.	none (appliance or network logs)
2	T1133 External Remote Services	The VPN appliance authentication log: user, source address, assigned internal address, session start and end. Flag logins outside the user's usual hours, from countries or hosting providers the user never uses, and from devices seen for the first time. Send this log off the appliance; both hospitals lost theirs.	none (appliance or network logs)
2	T1078 Valid Accounts	On internal hosts, successful logons whose source is the VPN address pool, by accounts that are dormant, belong to a contractor, or have never used the VPN. A run of failed logons before the first success.	Security4624Security4625
2	T1552.001 Unsecured Credentials: Credentials In Files	Not visible from Windows. This flaw class reads files on the appliance that hold credentials; CVE-2018-13379 did this at both hospitals. The sign comes later: logins with accounts whose passwords existed only on the appliance, such as local VPN users or the directory bind account.	none (appliance or network logs)
2	T1539 Steal Web Session Cookie	A VPN session used from a second source address without a new authentication event, or one user holding two concurrent sessions from different places.	none (appliance or network logs)
3	T1087.002 Account Discovery: Domain Account	One host querying every user and group in the directory within minutes. Domain controllers do not log ordinary directory reads by default; EDR or directory query logging shows it. On member servers, group membership enumeration is logged.	Security4798Security4799
4	T1003 OS Credential Dumping	EDR alerts on access to LSASS memory (Sysmon event 10, if Sysmon is deployed). On a domain controller, a copy of the directory database taken through a shadow copy. Both hospital reports name Mimikatz.	Sysmon10
4	T1078.002 Valid Accounts: Domain AccountsT1136.002 Create Account: Domain Account	A new account (4720), an account added to a security-enabled global group such as Domain Admins (4728) or to a local Administrators group (4732), and special privileges assigned to a logon that does not normally get them (4672).	Security4720Security4728Security4732Security4672
4	T1021.001 Remote Services: Remote Desktop ProtocolT1021.002 Remote Services: SMB/Windows Admin Shares	Logon type 10 (remote interactive) on hosts that are never used that way; firewall flows to the remote desktop port from one host to many. Access to administrative shares from a workstation, and a new service in the System log when a remote-execution tool such as PsExec runs. The Osaka intruder tried remote desktop to about 70 addresses from one server.	Security4624Security5140Security5145System7045
4	T1562.001 Impair Defenses: Disable or Modify Tools	Microsoft Defender events 5001 (real-time protection off) and 5007 (settings changed), Windows Installer event 11724 when a security product is removed, and an EDR agent that stops reporting. Clearing the Security log itself leaves event 1102 (T1070.001). The Osaka intruder uninstalled antivirus on the first hospital server.	Defender5001Defender5007Application11724Security1102
5	T1490 Inhibit System Recovery	Shadow copies disappear from servers. With process-creation auditing that records the command line (4688), or Sysmon event 1, the deletion is logged together with the account that ran it. The backup software's own audit log shows console logins at night, deleted jobs and shortened retention.	Security4688Sysmon1
6	T1048 Exfiltration Over Alternative ProtocolT1567 Exfiltration Over Web Service	Outbound volume per host far above its baseline, to cloud storage or file-transfer services. Archive tools running on servers (T1560.001). On the file server, one account reading thousands of files, visible with object-access or detailed share auditing. Osaka could not tell what a 7.9 MB SMB transfer contained because detailed logging was off.	Security4663Security5145
7	T1486 Data Encrypted for Impact	Thousands of file writes and renames per minute on file servers, a new file extension on everything (.elbie in Osaka), ransom notes in every folder or on every printer, and virtual machines shutting down on the hypervisor. By this point the signal is loud, and it is late.	none (appliance or network logs)

Source: MITRE Enterprise Techniques; Microsoft Advanced security audit policy settings (per-event pages linked from this reference: 4624, 4625, 4672, 4720, 4728, 4732, 4798, 4799, 5140, 5145, 4663, 1102); Osaka General Medical Center, Information Security Incident Investigation Committee 「調査報告書」 (pp.11–12, 18–19, 36–41, 45–47; pp.11, 37, 45–46, 71)

As one documented example, LockBit 3.0 deletes volume shadow copies and clears the Windows event logs.

Source: CISA and partners Understanding Ransomware Threat Actors: LockBit (AA23-165A)