Zero Hour: A Minute-by-Minute Account of What Ransomware Does to an Organization in Its First Three Days

The ransom note is never the beginning of the story. By the time that message appears on an employee's screen — often a stark black background, white text, a Bitcoin address, and a countdown timer — the attackers have typically been inside the network for days, sometimes weeks. The encryption event that triggers visible chaos is, from the attacker's perspective, the final act of a carefully staged operation. For the organization on the receiving end, it is the opening gun of a crisis that will consume every resource and test every assumption about preparedness.

What follows is a composite reconstruction of a ransomware incident at a mid-sized American company — a profile that represents the most common target class in current federal reporting. The details are drawn from publicly available incident response reports, Department of Justice case documents, and background conversations with cybersecurity professionals who have worked active ransomware engagements. No single real organization is depicted, but every element described reflects documented, recurring patterns.

The Weeks Before Zero Hour

The intrusion that will eventually paralyze the company did not begin with ransomware. It began with a phishing email — a message crafted to resemble a routine vendor invoice, sent to an accounts payable employee on a Tuesday afternoon. The employee clicked the attachment. A loader executed silently in the background. An initial access broker, operating as a separate criminal entity from the ransomware group that will eventually deploy the payload, now has a foothold.

Over the following two to three weeks, that foothold is quietly expanded. Credentials are harvested using tools like Mimikatz. The attacker maps the network, identifies the domain controller, locates backup infrastructure, and — critically — finds the backup system's administrative credentials stored in a shared folder that was never properly secured. The backup server is accessed and its agent software is disabled. This step, often overlooked in post-incident analysis, is what transforms a manageable incident into a catastrophic one.

The access is then sold or transferred to a ransomware-as-a-service affiliate, who deploys the encryption payload on a Friday evening — a timing choice that is deliberate. IT staff are reduced on weekends. Response times lengthen.

Hour Zero to Hour Four: Discovery and Paralysis

At 11:47 p.m. on a Friday, a monitoring alert fires. A security operations center analyst — if the company has one — sees unusual file modification activity spreading across multiple endpoints simultaneously. In companies without a dedicated SOC, the first signal is often a panicked call from a night-shift employee who can no longer open files.

Within minutes, the scope becomes apparent. File servers are inaccessible. The ERP system is offline. Shared drives display the ransom note in every directory. The domain controller, the heart of the network's identity infrastructure, has been encrypted. Email may still function — or it may not, depending on whether the mail server was on-premises.

The first critical error many organizations make in this window is attempting to contain the spread by pulling network cables and shutting down systems without first capturing forensic evidence. Volatile memory — RAM — contains artifacts that can identify the malware variant, attacker tooling, and lateral movement paths. Once a machine is powered off, that evidence is gone. Incident response firms consistently report that organizations who panic-shutdown everything in the first hour significantly impede their own investigation.

Leadership is notified. The CEO, CFO, and general counsel are typically reached by phone within the first two hours. The conversation that follows is one most executives have never rehearsed: Do we have cyber insurance? Who is our incident response retainer? Do we have an attorney-client privilege framework in place for the investigation? In many mid-sized companies, the answers are incomplete.

Hour Four to Hour Twenty-Four: The Scope Assessment

By early Saturday morning, an outside incident response firm has been engaged — either through a cyber insurance carrier or a direct relationship. Their first task is triage: which systems are encrypted, which are clean, and is the attacker still active in the environment.

This last question is not rhetorical. In a significant percentage of ransomware incidents, the threat actor maintains persistence even after deploying the payload. They observe the response, exfiltrate additional data during the confusion, and sometimes deploy a second encryption wave if they believe the first was partially contained. Incident responders must assume the attacker is watching until proven otherwise.

The backup situation is assessed and the results are frequently grim. The backup server is offline. Cloud backup synchronization, if it was running, may have faithfully replicated the encrypted files over the clean versions before anyone noticed. Immutable backup configurations — a design choice that specifically prevents this outcome — were not implemented. The most recent usable restore point is, in this composite scenario, eleven days old.

That gap — eleven days of transactions, customer records, and operational data — is now the central variable in every decision the company will make for the next 48 hours.

Hour Twenty-Four to Hour Forty-Eight: The Negotiation Question

By Saturday evening, leadership faces a decision that no business school curriculum adequately prepares executives to make. The ransom demand, in this scenario, is $1.4 million in Monero. The cyber insurer has been notified and a negotiation firm has been recommended. The FBI's Internet Crime Complaint Center (IC3) has been contacted — a step that is both legally advisable and practically useful, as federal investigators maintain intelligence on active threat actor groups and can sometimes provide decryption keys recovered from prior operations.

The negotiation process, conducted through a dark web chat portal the attacker provides, is more transactional than most people expect. Ransomware-as-a-service groups operate with customer service infrastructure, proof-of-decryption guarantees, and flexible payment timelines. This is a business to them. The negotiation firm typically achieves a reduction of 30 to 60 percent from the initial demand — not because of any moral leverage, but because threat actors price high expecting negotiation.

Paying the ransom does not guarantee recovery. Decryptors provided by ransomware groups are frequently slow, incomplete, or crash on large file sets. The FBI and CISA consistently advise against payment, both because it funds further criminal activity and because payment success rates are lower than commonly assumed. Yet for organizations facing the loss of eleven days of irreplaceable data and an indefinite operational shutdown, the calculus is rarely straightforward.

Hour Forty-Eight to Hour Seventy-Two: The Long Road Back

Recovery from a significant ransomware incident is measured in weeks, not days. The 72-hour window closes with the organization still largely offline, a forensic investigation underway, and a decision on the ransom either pending or recently made. Regulatory notification obligations — under HIPAA if health data was involved, under SEC rules if the company is publicly traded, under state breach notification laws in virtually every US state — are now running against legal deadlines.

The lessons that emerge from reconstructing incidents like this one are consistent across the public record. Organizations with tested, immutable, offline backups recover faster and pay ransoms less frequently. Those with documented incident response plans, practiced through tabletop exercises, make better decisions under pressure. Companies that have pre-negotiated retainer agreements with incident response firms lose fewer hours to vendor selection during the crisis itself.

For small business owners and employees who assume their organization is beneath a ransomware group's notice: federal data consistently shows that companies with fewer than 500 employees represent the majority of ransomware victims by volume. The targeting is often opportunistic, driven by the presence of an exploitable vulnerability or a successful phishing email — not by the size of the prize. Preparation, not scale, is what separates organizations that survive these events from those that do not.