Dwell Time Analysis: How Ransomware Operators Spend Their 21 Days
Post-incident analysis of 31 ransomware cases reveals a consistent pre-encryption timeline. Understanding it changes how organizations should prioritize detection.
The Number That Changes Everything
The average dwell time — the period between initial compromise and ransomware deployment — in the thirty-one cases we analyzed was twenty-one days.
Twenty-one days in which the attacker was present, active, and moving through the network. Twenty-one days in which detection was possible. Twenty-one days in which every hour represented an opportunity that was not taken.
This report is not about what happens after encryption. It is about those twenty-one days.
Day 1-3: Foothold Establishment
Initial access in twenty-seven of thirty-one cases came through one of three vectors: phishing, exposed RDP, or exploitation of a known unpatched vulnerability. In none of these cases was the initial access particularly sophisticated.
The first days are spent quietly. The attacker confirms they have access. They test their ability to reach external infrastructure. They map what they can see. They do almost nothing that would trigger a high-severity alert in a well-tuned environment.
Day 4-14: Lateral Movement
This is where modern ransomware operators distinguish themselves from earlier generations. They do not rush. They move deliberately, using native tooling — WMI, PowerShell, legitimate remote administration software — to avoid detection signatures built around known malware.
In nineteen of thirty-one cases, the attacker’s lateral movement traffic was indistinguishable from legitimate administrative activity at the packet level. Detection required behavioral analysis.
Day 15-21: Preparation
The week before encryption is the most active. Data is staged for exfiltration. Backup systems are targeted. Domain administrator credentials are obtained if they have not been already. The kill switch for security tooling is located.
In this phase, the attacker is preparing to make their presence visible. For the first time, speed matters to them. For the defender, this is the last window.
What This Means for Detection Strategy
The implication is uncomfortable but clear: if an organization’s detection strategy is tuned primarily to identify malware signatures, it will miss the first seventeen days of a ransomware intrusion. By the time known-bad indicators appear, the attacker has already achieved their objectives.
Detection must move earlier in the kill chain, or it does not provide meaningful protection against this class of threat.