Ransomware resilience: what changes when attackers move faster?

TL;DR: Ransomware has become 13x faster than many defences can detect, according to Halcyon, while recent incidents at Change Healthcare and CDK Global show how silent intrusion, double extortion and disrupted recovery can amplify operational damage. Containment and recovery discipline now matter more than assuming prevention will hold.

Editorial analysis by NHI Mgmt Group, based on content published by Halcyon: “The Quick Guide to Ransomware Resilience”.

By the numbers:

• AI has made ransomware 13x faster than most defenses can detect.
• In February 2024, Change Healthcare faced a breach that no one saw coming.

Key questions

Q: What fails when ransomware defenders rely only on prevention?

A: Prevention alone fails when attackers already have enough access to move quietly, steal data or disrupt recovery before defenders notice.

Q: Why does double extortion create more operational risk than encryption alone for ransomware victims?

A: Double extortion raises the pressure on incident response because attackers can threaten both availability and confidentiality at the same time.

Q: What are the signs that ransomware is already moving through an environment?

A: Common warning signs include unusual file renaming or bulk rewriting, privilege escalation, suspicious lateral movement, sudden system slowdown or crashes, and outbound connections to known malicious infrastructure.

Practitioner guidance

• Strengthen identity containment during ransomware response Separate privileged admin paths, isolate recovery accounts and revoke suspicious access before systems are brought back into service.
• Protect backup and restore workflows Test whether backup systems, storage consoles and restore credentials can be reached by the same account set that attackers typically abuse.
• Shorten detection-to-containment intervals Measure the time from first suspicious activity to account lockout, network isolation and host containment, then tune alerting to reduce that interval.

Bottom line: Ransomware resilience fails when organisations assume detection will arrive before attackers can move, steal data or interfere with recovery.

Explore further

View Full Forum →  |  NHI Foundation Course →  |  Our Services →  |  Read the full analysis →