It started with a single notification. An IT administrator at a mid-sized professional services firm spotted an unauthorized login attempt from an unrecognized IP address at 11:47 PM on a Tuesday. By the time the internal team started investigating the following morning, the attackers had already bypassed the initial security layers and were 14 days into silent reconnaissance. The entry point? A recycled password—the kind used across multiple platforms because it's easier to remember—that had been exposed in a third-party data breach six months earlier. The executive whose credentials were compromised had no idea. And neither did anyone else. Until the 15th day.
The 14-Day Dwell: What Attackers Do While You Sleep
Attackers don't strike the moment they gain access. Modern ransomware groups practice 'dwell time'—staying invisible inside a network for days or weeks to maximize damage before revealing themselves. During those 14 days, this group:
- Mapped the company's entire internal server structure and identified crown-jewel data
- Located and inventoried sensitive client files and financial records
- Identified and disabled automated backup routines to eliminate the restore option
- Exfiltrated 50GB of client data to an external server before encrypting anything
- Escalated privileges quietly until they had domain-admin access
Day 15: The Lock-Out
Staff arrived to find every workstation displaying the same screen—a ransom note:
- 'We have encrypted your files and downloaded 50GB of your private client data.'
- 'You have 48 hours to pay 5 BTC (~$80,000), or this data will be sold on the dark web.'
- Email access: locked. CRM: locked. Accounting software: locked. Backups: destroyed.
- This was a dual-threat attack: Ransomware (file encryption) + Extortion (data leak threat)
The Aftermath: The True Cost
The company chose not to pay the ransom. They hired a cybersecurity forensics firm and began rebuilding from offline backups. But the damage was severe: