Enterprise ransomware has evolved from opportunistic commodity attacks into sophisticated, multi-stage extortion campaigns orchestrated by organised criminal groups with the operational discipline of advanced persistent threat actors. The 2026 threat landscape is defined by Ransomware-as-a-Service (RaaS) affiliates who purchase access to enterprise networks from Initial Access Brokers (IABs), deploy fileless malware to evade detection, conduct weeks of reconnaissance within the target environment, exfiltrate sensitive data for double-extortion leverage, and only then detonate the encryption payload at maximum impact.
Stage 1 — Pre-Encryption Detection: The Critical Window
The single most operationally consequential capability in ransomware defence is detection at the pre-encryption stage — identifying the adversary's presence during the dwell period before the encryption payload executes. Dritrez intelligence indicates that the median dwell time for enterprise ransomware campaigns is 14 days. This represents a 14-day detection window that most enterprise security operations centres fail to exploit.
Pre-encryption behavioural indicators that reliably signal active ransomware staging include:
Credential Harvesting Activity: Tools such as Mimikatz, LaZagne, or LSASS
memory dumping via custom loaders consistently appear in the dwell phase. EDR telemetry showing
unexpected access to lsass.exe process memory is a high-fidelity indicator of
active credential harvesting that should trigger immediate investigation.
Active Directory Enumeration: BloodHound-based AD enumeration — characterised by mass LDAP queries against the Domain Controller, anomalous PowerShell execution involving AD module cmdlets, and unusual SPN enumeration — indicates that an adversary is mapping the path to Domain Admin compromise.
Mass File System Enumeration: In the 48-72 hours immediately preceding encryption, ransomware actors typically conduct a mass file system survey to identify high-value data stores and calculate encryption sequencing. This manifests as sustained, high-throughput SMB traversal across network file shares from a single compromised host — trivially detectable by file access pattern anomaly detection.
Backup Infrastructure Discovery and Targeting: The deliberate targeting of backup infrastructure — Veeam servers, Windows Server Backup, shadow copies — is a terminal pre-encryption indicator. Any account accessing backup infrastructure outside documented backup maintenance windows should be automatically quarantined pending investigation.
Stage 2 — Automated Containment and Blast Radius Isolation
When pre-encryption indicators are confirmed, containment must execute at machine speed. A human analyst reviewing an alert and manually initiating isolation procedures introduces minutes of exposure that translate to hundreds of encrypted systems in a fast-moving campaign.
Dritrez deploys automated SOAR playbooks that execute the following containment sequence within 60 seconds of confirmed indicator correlation:
1. Immediate Host Isolation: The EDR platform executes network isolation on the identified compromised host — severing all network connectivity while preserving the local management channel to the EDR console for forensic data collection.
2. Credential Invalidation: All Active Directory accounts associated with the compromised host's recent authentication are force-expired. Service accounts with SPNs on the isolated host have their passwords rotated. Kerberos tickets are invalidated through a targeted krbtgt password rotation sequence.
3. Network Micro-Segmentation Enforcement: The SOAR platform pushes emergency firewall policy updates across all network segments — blocking all east-west SMB (445/tcp) and WMI traffic not specifically authorised in the approved traffic matrix. This prevents encryption propagation to adjacent segments even if additional compromised hosts have not yet been identified.
4. Backup Infrastructure Lockdown: Backup repositories are immediately placed in read-only mode and their network access rules are updated to deny-all from the corporate network. Backups remain accessible only from the isolated backup management network.
"You cannot recover from ransomware without immutable, air-gapped backups. Every other control buys you time. Backups determine whether you recover in hours or never."
Stage 3 — Immutable Backup Architecture
The fundamental precondition for a ransomware recovery that does not involve paying the ransom demand is an immutable, offline or air-gapped backup repository that the adversary cannot reach, enumerate, or encrypt.
The Dritrez backup hardening standard mandates the 3-2-1-1-0 backup rule: 3 copies of data, on 2 different media types, with 1 offsite copy, 1 air-gapped or immutable copy, and 0 errors validated through monthly automated recovery testing. The immutable copy is stored in an OCI Object Storage bucket with object lock enabled — preventing any modification or deletion for the defined retention period, regardless of which credentials attempt the operation.
Stage 4 — Forensic Recovery Sequence
Ransomware recovery must be executed as a forensic process, not an emergency restoration. Restoring from backup onto a network that still contains active adversary footholds will result in immediate re-encryption of restored systems — a catastrophic and entirely avoidable failure mode.
The Dritrez recovery sequence enforces forensic validation before any system restoration commences: threat actor persistence mechanisms are identified and eliminated across all discovered footholds; the initial access vector is identified, remediated, and confirmed closed; and a clean, attested network environment is provisioned before restoration begins. Recovery systems are staged on an isolated VLAN with no connectivity to production until full forensic clearance is obtained.