Ransomware is rarely a single explosion of encrypted files — it is a sequence of deliberate steps, and Proofpoint's ransomware attack chain runs to eight distinct stages, from reconnaissance through to end-stage impact, not the one-shot event many budgets are still built to stop. Counts vary by vendor: Huntress maps a seven-stage lifecycle, Cybereason's Gartner-derived model condenses the same behaviour into five stages, and Lockheed Martin's original cyber kill chain — the seven-step model this all descends from — was built for adversary planning generally, not ransomware specifically. The stage counts differ, but the underlying logic is consistent: attackers get in, dig in, spread out, steal data, then detonate. For UK organisations building cyber security services, that sequence is the blueprint for where a layered set of controls needs to break the attack before encryption or data theft ever happens.
View the data behind this chart
| Model Name | Stage Count | Design Origin | |
|---|---|---|---|
| Lockheed Martin | Cyber Kill Chain | 7 stages | Military-derived model |
| Proofpoint | Ransomware Chain | 8 stages | Ransomware-specific |
| Huntress | Ransomware Lifecycle | 7 stages | Ransomware-specific |
| Cybereason/Gartner | Gartner Summary | 5 stages | Analyst-derived |
Why a Chain, Not an Event
Every major vendor now frames ransomware as a chain rather than a single detonation, because the file-locking moment is the last thing that happens, not the first. Proofpoint's model runs to eight stages; Huntress counts seven; Cato Networks and the Cybereason summary of Gartner's research both use five. None of these are wrong — they are different levels of granularity applied to the same underlying behaviour.
The practical value for a UK IT buyer is not memorising which vendor uses which number. It is recognising that every one of these models agrees on the same structural point: there are several discrete windows, before encryption, where the attack can be detected and stopped. Purdue University's mapping work makes this explicit — the distinct stages line up with both the classic Lockheed Martin cyber kill chain and MITRE ATT&CK, which means defenders have more than one framework to check their coverage against, not just one.
Where the Models Come From — and Why They Disagree
Lockheed Martin's cyber kill chain is a seven-step model built to identify targets during an adversary's planning phase; it predates ransomware as a dominant threat and was designed as a general intrusion framework. Purdue's analysis maps the initial-intrusion stage of ransomware to three of those Lockheed Martin phases — Reconnaissance, Weaponization and Delivery — and to three equivalent MITRE ATT&CK tactics: Reconnaissance, Resource Development and Initial Access.
Purdue then maps the ransomware midgame — after the initial break-in — to Lockheed Martin's Exploit, Installation and Command & Control phases, and to the ATT&CK tactics sitting between Execution and Command & Control. This is the source of most disagreement between vendor models: some frameworks are attacker-centric and start before the victim is ever touched (weaponisation, delivery), while others — like Proofpoint's and Huntress's ransomware-specific chains — start counting once the victim's environment has already been touched. Neither is more correct; they answer different questions.
The Modern Ransomware-Specific Chain, Stage by Stage
Proofpoint's eight-stage model is the most granular ransomware-specific breakdown available: reconnaissance, initial compromise, persistence, information gathering, privilege escalation, lateral movement, staging, and end-stage impact. Cato Networks compresses similar behaviour into five stages — initial access and infection, lateral movement and propagation, command-and-control communication, data exfiltration, and encryption — while the Cybereason summary of Gartner's work uses ingress, compromise, burrowing/tunnelling, command and control, and encryption.
Akamai's version adds a useful detail: initial access is typically spear phishing or exploitation of a vulnerable exposed service, followed by lateral movement, exfiltration, encryption, and finally impact. Every single model, regardless of stage count, includes lateral movement as a discrete step — because it is the stage where an attacker converts a single compromised account or machine into control of enough of the network to make ransom demands worth paying.
Staging, Exfiltration and the Multi-Extortion Stage
Double and multi-extortion ransomware does not appear from nowhere at the encryption stage — it is built during staging and exfiltration, well before any files are locked. Proofpoint places staging immediately before end-stage impact, reflecting that attackers prepare their payload and select their targets before detonation; this is also when stolen data is packaged for leak-site threats.
Huntress describes the command-and-control stage as outbound communication used to issue commands and prepare for data theft, frequently carried over encrypted and obfuscated traffic — which is precisely why it is hard to spot with traditional signature-based tools. The clearest tell that an attack has reached the exfiltration stage, per Huntress, is a combination of rapid file access and unusually large data transfers. Any defence that only watches for the encryption event and ignores this earlier data-movement signature will see the extortion threat only after the data is already gone.
Breaking the Chain: What to Do at Each Stage
Purdue's core finding is the one worth building a security programme around: because the stages map cleanly to both Lockheed Martin's model and MITRE ATT&CK, defenders can interrupt ransomware before the final payload is ever launched. That means each stage deserves its own control, not a single tool positioned to catch everything at the end.
- •Reconnaissance and initial compromise: reduce the exposed attack surface and harden the identity layer — this is where implementing Zero Trust principles pays off, by refusing to trust a login or device just because it presented valid credentials.
- •Persistence and privilege escalation: monitor for unexpected new accounts, scheduled tasks and registry changes rather than relying solely on antivirus signatures.
- •Lateral movement: network segmentation limits how far a single compromised account can reach — Akamai's own kill-chain work explicitly targets this stage as the point of maximum leverage for defenders.
- •Command-and-control communication: outbound traffic monitoring and managed detection & response are needed here because, per Huntress, this traffic is often encrypted and deliberately obfuscated to blend in.
- •Staging and data exfiltration: watch for the rapid file access and large data transfer pattern Huntress identifies — this is the last realistic checkpoint before a multi-extortion threat is fully formed.
- •End-stage impact (encryption): this is the failure state, not the primary control point — understanding immutable backups determines whether recovery is fast or catastrophic once this stage is reached.
View the data behind this chart
| Layer | Detail |
|---|---|
| Initial Access & Infection | Attacker gains first foothold in the network |
| Lateral Movement & Propagation | Attacker spreads across systems and accounts |
| Command-and-Control Communication | Encrypted outbound traffic directs the attack |
| Data Exfiltration | Sensitive data is copied out before encryption |
| Encryption | Files are locked and the ransom demand is issued |
A Worked Walkthrough of the Chain in Practice
It helps to trace one illustrative path through Proofpoint's eight stages to see how the checkpoints connect. Reconnaissance identifies an exposed service or a plausible phishing target. Initial compromise delivers a foothold — a credential or a foothold on one machine. Persistence follows immediately, so the attacker survives a reboot or a password reset. Information gathering and privilege escalation then map the network and hunt for domain-admin-level access.
Lateral movement is where the attack stops being a single-machine incident and becomes an organisation-wide one, spreading — as Akamai notes — for maximum eventual impact. Staging follows: the attacker selects high-value data, exfiltrates it, and prepares the encryption payload for detonation across as many hosts as possible. End-stage impact is the visible event — files locked, ransom note dropped, and, in a multi-extortion scenario, a leak-site countdown already running because the data left the network during staging, long before anyone saw a ransom note.
The UK Angle: Anchoring Decisions in NCSC Guidance
For UK buyers, the NCSC remains the most relevant national reference point when deciding where to place investment across this chain. The operational question is not "which vendor's kill chain diagram looks most complete" but "which specific stage does this control actually cover, and which stage is still uncovered." A supplier claiming to "stop ransomware" needs to be pinned down to a stage: is it blocking initial access, detecting lateral movement, catching exfiltration, or only helping with recovery after encryption?
Because per-incident cost and pricing data vary widely by sector and are frequently disputed across different studies, the more useful exercise for a UK IT buyer is to map every existing control — email filtering, endpoint agents, network monitoring, backup — against the stage list above and identify the gap. In practice, most organisations discover they have reasonable reconnaissance and initial-compromise coverage (email security, endpoint protection) but weak or absent coverage of lateral movement and staging, which is exactly where multi-extortion decisions get made.
Why Security Stacks Still Fail Against This Chain
The most common failure mode is treating ransomware as an endpoint problem to be solved at the encryption stage, when every model reviewed here places at least three or four earlier stages between initial compromise and detonation. A stack built entirely around stopping the final payload will, by definition, miss the exfiltration that already happened during staging — meaning even a successfully blocked encryption event can still result in a data-leak extortion demand.
The second failure is fragmentation: different tools purchased at different times to solve different point problems, none of them mapped to a shared stage model, leaving blind spots exactly at the seams — typically between the initial-access tools (email, endpoint) and the network-layer tools (segmentation, monitoring) that should catch lateral movement. Building resilience means treating the kill chain as a checklist to audit existing coverage against, not a diagram to admire.
Sources
Every figure in this article traces to the sources below.
- •Proofpoint UK — eight-stage ransomware attack chain
- •Purdue University — framework mapping of ransomware stages to Lockheed Martin and MITRE ATT&CK
- •Cato Networks — five-stage ransomware kill chain definition
- •Cybereason — Gartner's five ransomware stages
- •Lockheed Martin — classic seven-step cyber kill chain
- •Akamai — ransomware kill-chain infographic on lateral movement
- •Huntress — command-and-control and exfiltration indicators