Ransomware Dwell Time: Attackers Spend Weeks Inside Your Network Before You See a Ransom Note

Most business owners picture ransomware as a sudden strike: screens go dark, files lock, operations stop. That picture is wrong – and it’s costing businesses that believe it. Incident data from 2024 and 2025 tells a different story. Attackers aren’t smash-and-grab criminals. They’re patient. They get in, go quiet, and spend days or weeks stealing data, mapping your network, and neutralizing your backups before a single file is encrypted. By the time you see the ransom note, the most damaging work is already done. Understanding ransomware dwell time – and what attackers do during that window – is where real ransomware defense begins.

1. Ransomware Dwell Time by the Numbers: What Recent Data Shows
2. The Ransomware Kill Chain: What Happens Before Encryption
3. Who Is Actually Being Targeted: Small Business Is Not a Safe Harbor
4. What Real Incidents Look Like: Patterns From 2024 – 2025 Response Data
5. Why Standard Defenses Miss the Reconnaissance Phase
6. Building a Defense Posture Around Dwell Time, Not Just Recovery
7. Questions to Ask Your IT Firm Right Now

Ransomware Dwell Time by the Numbers: What Recent Data Shows

Mandiant’s M-Trends 2024 report documented a global median dwell time of 10 days across all intrusion types. Ransomware-specific cases targeting organizations with limited detection capabilities frequently run well past that number. We’re talking weeks, not hours.

CISA’s StopRansomware advisories, published throughout 2024 and into 2025, document specific threat groups maintaining persistent access for anywhere from two weeks to several months before deploying encryption. The 2024 advisory on Black Basta noted that affiliates routinely spent significant time inside target environments – mapping Active Directory, locating backup systems, and exfiltrating data – before the encryption payload ever ran.

The FBI’s Internet Crime Complaint Center 2023 annual report – the most recent full-year data available at time of writing – logged over 2,825 ransomware complaints with adjusted losses exceeding $59.6 million. Analysts noted those figures represent a fraction of actual incidents: many businesses either don’t recognize a breach occurred or choose not to report it.

What the data confirms is this: the window between intrusion and encryption is measured in days and weeks, not hours. That window is when attackers do their most destructive work – and it’s precisely the window a dwell-time-aware defense is built to close.

The Ransomware Kill Chain: What Happens Before Encryption

Most business owners focus on recovery: “Do we have good backups?” That matters – but it only addresses the final act of a multi-stage operation. Here’s what actually happens during the pre-encryption phase, based on patterns documented in CISA advisories and published incident response findings.

Initial Access

Attackers get in through a small number of reliable entry points: a phishing email that captures credentials, an internet-facing system with an unpatched vulnerability, or stolen credentials purchased from a criminal marketplace. Remote Desktop Protocol exposed to the internet remains a top entry vector in 2024 CISA advisories. Day one isn’t sophisticated or targeted. It’s opportunistic access that attackers then convert into something far more dangerous.

Establishing Persistence

Once inside, the first priority isn’t theft or encryption – it’s staying. Attackers install remote access tools, create new administrative accounts, and modify legitimate system utilities to maintain access even if the original entry point is closed. Because they’re using tools already present on your systems – Windows management utilities, scripting engines, remote monitoring software – their activity looks, at a glance, like routine IT work.

Internal Reconnaissance and Ransomware Dwell Time

This is the phase that explains the dwell time numbers. Attackers spend days or weeks mapping the internal network: identifying every system, locating data and where it lives, finding backup systems and determining whether they’re offline or connected, cataloging user accounts and privilege levels. They’re drawing a detailed map of your business. Every hour of this phase makes the eventual attack more precise and more destructive.

Privilege Escalation

With that map in hand, attackers work to acquire administrator-level or domain-level credentials. This is often done through tools that extract passwords stored in memory on a compromised machine. Once they hold the keys to your domain, every system on the network is reachable.

Data Staging and Exfiltration

Before any file is encrypted, data is stolen. This is now standard operating procedure for major ransomware groups. They compress files containing financial records, client data, employee information, and intellectual property, then upload that archive to attacker-controlled servers. This is the origin of double extortion: pay to get your files back, and also pay to keep the stolen data from being published. If you restore from backup and decline to pay, the publication threat doesn’t go away.

Lateral Movement to Backup Systems

Sophisticated groups specifically seek out backup systems before deploying encryption. If your backups are network-connected and reachable from a compromised administrator account, they’re not safe. Incident response firms document this pattern regularly: organizations find their backup systems encrypted alongside production systems, because both were accessible from the same compromised account.

Encryption Deployment

Only after all of the above does the encryption payload run. By this point, the attackers may know your network better than your IT team does. The ransom note isn’t the beginning of something. It’s the announcement that it’s already over.

Who Is Actually Being Targeted: Small Business Is Not a Safe Harbor

A persistent and dangerous myth in the small business community is that ransomware groups are only interested in large enterprises. The logic seems reasonable: why spend weeks inside a network when the ransom potential is modest? IC3 data and CISA advisories dismantle that assumption directly.

Small businesses are attractive targets for reasons that have nothing to do with ransom size. They frequently hold valuable client data – particularly in professional services, healthcare, legal, financial, and accounting sectors. They often have weaker detection capabilities, meaning attackers can extend dwell time with less risk of discovery. And they’re frequently connected to larger organizations as vendors, giving attackers a path into higher-value targets through supply chain compromise.

CISA advisories on groups like Scattered Spider, Akira, and LockBit variants document attacks on organizations of all sizes. Akira in particular – addressed in a joint CISA and FBI advisory in 2024 – has shown a clear pattern of targeting small and mid-sized businesses across healthcare, professional services, and manufacturing.

The question isn’t whether your business is large enough to be a target. The question is whether your environment is quiet enough for an attacker to operate undetected for weeks. For most small businesses running standard antivirus and a basic firewall, the honest answer is yes.

What Real Incidents Look Like: Patterns From 2024 – 2025 Response Data

Published incident response findings from 2024 and early 2025 reveal consistent patterns in how the dwell time problem plays out for smaller organizations. Specific client names are never disclosed in published reports, but the operational patterns are well documented.

• A professional services firm discovers encryption across all workstations and a ransom note demanding a six-figure payment. Investigation reveals the attacker first accessed the network via a phishing email 23 days earlier, spent two weeks mapping internal systems, exfiltrated a compressed archive of client files 11 days before encryption, and compromised the backup server 4 days before encryption. The business had no detection capability that would have flagged any of it.
• A healthcare-adjacent organization pays the ransom and restores operations, believing the incident is closed. Months later, the stolen data appears on a dark web publication site. The ransom payment secured only the decryption key – not deletion of the exfiltrated files. The double-extortion leverage existed from the moment data was staged, regardless of payment.
• A manufacturing firm discovers that an attacker used a compromised IT administrator account to map both the business network and connected operational systems over more than 30 days. The extended dwell time was possible because the attacker was operating in systems the IT team didn’t regularly audit.

These are not outliers. They are the documented standard behavior of active ransomware groups operating in 2024 and 2025.

Why Standard Defenses Miss the Reconnaissance Phase

Traditional endpoint protection tools are built to detect known malicious files and behaviors. Modern ransomware groups increasingly operate without deploying traditional malware. They use tools already present on your systems – legitimate Windows administrative utilities – to conduct reconnaissance, move laterally, and stage data. This technique, often called “living off the land,” produces attacker activity that is functionally indistinguishable from routine IT administration at the file and process level.

Detecting this class of activity requires behavioral analysis across the entire environment: monitoring for unusual account creation, abnormal authentication patterns, large internal file transfers, unexpected outbound data movement, and privilege escalation events. A basic antivirus subscription or a consumer-grade firewall doesn’t provide this. It requires continuous monitoring of event logs, network traffic, and authentication records by people and systems that know what normal looks like in your specific environment.

The gap between what most small businesses have deployed and what’s required to detect a patient, living-off-the-land attacker is significant. Closing that gap isn’t primarily a technology purchase. It’s a design and operations decision about how your environment is built and watched.

According to the NIST Cybersecurity Framework, the “Detect” function – continuous monitoring and anomaly detection – is one of five core pillars of a mature security posture. Most small businesses invest in the “Protect” pillar (firewalls, antivirus) and leave “Detect” largely unaddressed. That imbalance is exactly what extended ransomware dwell time exploits.

At Xact IT, we start with environment design – building networks that generate the right visibility signals from the ground up, rather than bolting detection onto an environment that wasn’t built for it. You can read more about our approach to cybersecurity for small and mid-sized businesses or explore our managed IT services that include continuous monitoring.

Building a Defense Posture Around Dwell Time, Not Just Recovery

Treating ransomware as a slow, deliberate process rather than a sudden event changes what a sound defense actually looks like. Recovery capability – good backups, a tested restoration process, a documented response plan – remains essential. But it doesn’t address what happens during the weeks an attacker is inside before encryption runs. A dwell-time-aware defense posture covers the following.

Offline and Immutable Backups

Backups must be stored in a state that a compromised administrator account cannot modify or delete. That means physically offline media, cloud storage with immutability settings enabled, or backup systems with separate credentials that are never exposed to the production domain. Backups that share authentication with production systems aren’t safe backups – they’re a second attack surface.

Continuous Authentication Monitoring

Most intrusion activity generates authentication events that are detectable if someone is watching. Unusual login times, logins from unexpected locations, new accounts with elevated privileges, and rapid failed authentication attempts across multiple systems are all signals. Those signals only become alerts if authentication logs are being reviewed continuously – not quarterly.

Network Segmentation

An attacker who compromises a single workstation shouldn’t have an open path to every other system on the network. Segmentation limits the blast radius of any single compromised credential. It also slows lateral movement, increasing the likelihood that behavioral monitoring catches anomalies before the attacker reaches high-value systems.

Privileged Access Controls

The number of accounts with domain administrator privileges in a typical small business environment is almost always higher than it needs to be. Every unnecessary privileged account is a lateral movement opportunity. Reducing that count, requiring additional authentication for privileged access, and auditing privileged account usage regularly are foundational controls that directly address how attackers operate during the dwell time period.

A Tested Incident Response Plan

Knowing what to do in the first hours after discovering an intrusion matters enormously for limiting damage. Businesses that have documented and practiced their response – who gets called, what systems get isolated, when law enforcement is notified, who holds decision authority – consistently fare better than businesses improvising under pressure. The plan should be documented, reviewed at least annually, and tested against realistic scenarios.

Questions to Ask Your IT Firm Right Now

If you want to know whether your current IT support has addressed the ransomware dwell time problem, ask these specific questions. Vague answers are themselves informative.

• Can you show me what your monitoring actually covers? Specifically – are you watching authentication events, privileged account activity, and internal file movement continuously, or only reviewing logs after something is reported as wrong?
• If an attacker created a new domain administrator account on our network tonight, how long would it take you to detect it? Walk me through the actual detection path.
• Where are our backups stored, and can a compromised administrator account reach them? Have you tested a full restoration from those backups in the last six months?
• What does our environment look like to an attacker trying to move laterally? How many systems could a single compromised workstation reach without requiring additional credentials?
• How would you know if someone was staging large volumes of our files for exfiltration? What generates an alert for that activity right now?
• When did we last do an internal review for unauthorized accounts, unexpected software, or anomalous network connections?

These questions have concrete, demonstrable answers. An IT firm that has built your environment with detection in mind can show you the monitoring dashboards, the alerting rules, and the coverage maps. A firm that hasn’t will offer reassurance without evidence.

Ransomware dwell time is, at its core, a visibility problem. Attackers thrive in environments where no one is watching carefully enough to notice them. The encryption event that shuts your business down is the loud ending to a quiet story that started weeks earlier – a story that a well-designed, continuously monitored environment would have interrupted long before the attacker got to deploy their payload. The businesses that avoid ransomware losses aren’t the ones with the fastest recovery capability. They’re the ones that noticed something was wrong before the attack ever reached its final stage.

Want to know where your environment stands? Book a Free Cybersecurity Strategy Call – a 20-minute conversation with our team, no obligation.