How to know if you have ransomware: the warning signs before and during an attack

Why the ransom note is the last thing to appear, not the first

A modern ransomware attack is not a single event. It is a campaign that typically unfolds over days or weeks: an attacker gains access, quietly explores the network, steals credentials, disables defenses, exfiltrates data, and only then launches the encryption that locks you out. The ransom note is the final act, designed to be the first thing you notice. By the time it appears, every chance to stop the attack cheaply has already passed.

This is why learning to recognize the earlier signs matters so much. Every stage before encryption leaves traces, and an organization that knows what to look for, or runs tooling that watches for it automatically, can intervene while the attack is still a contained intrusion rather than a full-blown crisis. The signs below are grouped by how early they appear.

Early signs: an attacker is inside and preparing

The earliest signs are subtle and easy to miss without monitoring, because the attacker is trying hard not to be seen. These are the ones worth watching for most closely.

• New or unexpected accounts, especially admin accounts, or existing accounts suddenly gaining elevated privileges.
• A credential behaving unlike itself: logging in at odd hours, from a new location, or reaching systems it never normally touches.
• Security tools being quietly disabled, uninstalled, or failing to report, a hallmark of attackers clearing the way before encryption.
• Unexpected remote-access sessions or new remote-access tools appearing on the network.
• Internal network scanning, where one machine starts probing many others, which is reconnaissance for lateral movement.

Mid-stage signs: the attack is accelerating

As the attacker moves from preparation toward action, the signs become more pronounced. At this stage data theft is usually underway, because nearly all modern ransomware steals data before encrypting it, the double-extortion model.

• Large or unusual outbound data transfers, particularly to unfamiliar external addresses or cloud-storage services, a signal that exfiltration is in progress.
• Lateral movement: the same credential or tool appearing on machine after machine as the attacker spreads.
• Backup systems being accessed, altered, or deleted, because attackers destroy backups first to remove your recovery option.
• Unusual spikes in CPU or disk activity on servers, sometimes the first visible symptom of staging or early encryption.

Late signs: encryption has begun

By the time these appear, the attack is active and every second counts. The priority shifts from prevention to containment and recovery.

• A sudden surge in files being renamed, with strange new extensions, or becoming inaccessible.
• Files you can no longer open, or applications failing because their data files are encrypted.
• Ransom notes appearing as text files in folders or as a changed desktop background.
• Systems locking users out or shutting down unexpectedly across multiple machines at once.

What to do the moment you suspect ransomware

If you see these signs, act immediately and deliberately. Speed matters, but so does not destroying evidence or triggering the attacker to accelerate.

• Isolate affected systems from the network to stop the spread, but do not power them off, as that can destroy forensic evidence in memory.
• Do not pay or engage the attacker before involving your incident-response team and, where appropriate, law enforcement.
• Preserve logs and evidence for investigation and for any breach-notification determination.
• Activate your downtime and recovery procedures, and restore from backups you have verified are clean and were not reachable by the attacker.
• Notify the people who need to know, including leadership, legal, and any regulator your sector requires.

How long attackers are usually inside before you notice

One of the most sobering facts about ransomware is how long attackers typically operate undetected before they strike. Industry incident-response data consistently shows intruders dwelling inside networks for days, and often far longer, between initial access and the moment they launch encryption. That dwell time is not wasted on their side: it is spent mapping the network, stealing credentials, identifying and destroying backups, and locating the most valuable data to exfiltrate. It is also, from your side, a long window of opportunity that most organizations miss entirely.

The reason the window gets missed is that the warning signs during dwell time are individually unremarkable. A single new account, one odd login, a backup job that failed once, a bit of extra network traffic, none of these trips an alarm on its own. It is only the pattern, assembled across many signals and correlated over time, that reveals an attack in progress. Human teams rarely have the time or the complete view to assemble that pattern live, which is why so many organizations only connect the dots after the ransom note lands.

Why automated detection changes the odds

The hard truth is that most of the early and mid-stage signs are nearly impossible for a human team to catch in real time across a large network, especially a small team watching thousands of systems. A credential logging in at an odd hour or one machine quietly scanning others does not look alarming on its own; it only becomes obvious in hindsight. This is exactly where automated, behavior-based detection earns its place.

We built our platform to watch for precisely this pattern of signals and fuse them into a single, high-confidence verdict in seconds, then contain the threat automatically before encryption can finish. For the detection side in more depth, see our guide to the early-warning signals of ransomware, and for the mechanism behind it, how Immune works. The goal is to make sure the first time you hear about an attack is from your own system catching it, not from a ransom note.