Huntress Report Finds Ransomware Deployment Averaged Nearly 17 Hours After Initial Access
Summary
Huntress’s analysis of investigated ransomware incidents found an average time-to-ransom of nearly 17 hours. Two incident examples show attackers dumping credentials, evading defenses, and moving laterally before encryption.
Key points
- Across the incidents analyzed, attackers took nearly 17 hours on average to deploy ransomware and performed an average of 18 actions beforehand.
- Some groups averaged just over four hours from initial access to ransomware deployment; Phobos and Maze averaged more than 30 pre-deployment actions, while Conti, Play, and Black Basta averaged fewer than 10.
- Huntress measured time-to-ransom from initial access or the first observed malicious activity to ransomware deployment, using investigated customer incidents dating back to late 2023.
- The analysis found that most threat actors exfiltrated data shortly before deploying ransomware.
- In a healthcare incident involving INC ransomware, the article describes credential dumping with ProcDump and an attempt to disable Microsoft Defender.
- In a separate Akira incident, the attacker used WMI to support lateral movement over RDP and ran a PowerShell command to disable Restricted Admin mode.
- Huntress cautions that incomplete endpoint coverage, late installation, disabled event logs, and network size can affect visibility and timing estimates; it recommends tested offline encrypted backups and incident-response playbooks.
Article Details
- Publisher
- Huntress
- Report Period
- Late 2023 onward; includes incidents from December 2024
- Scope
- Huntress-investigated ransomware incidents in customer environments; analysis of time-to-ransom and activity before deployment
- Key Statistics
- Average time-to-ransom across security incidents was almost 17 hours.
- Ransomware groups took an average of 18 actions before deploying ransomware.
- Some threat actors averaged just over four hours from initial access to ransomware deployment.
- Phobos and Maze averaged more than 30 actions in the 48-hour period before deployment; Conti, Play, and Black Basta averaged fewer than 10.
- A 2024 Statista report cited an average interruption of 24 days after ransomware attacks at US businesses.
- Recommendations
- Keep offline, encrypted backups of critical data and test them in disaster recovery scenarios.
- Create and regularly review an incident response playbook covering remediation, containment, recovery, breach notification, compliance, and communications.
MITRE ATT&CK
T1003.001 · LSASS MemoryThe INC ransomware incident involved dumping credentials from LSASS process memory.T1021.001 · Remote Desktop ProtocolThe Akira incident involved lateral movement across RDP.T1047 · Windows Management InstrumentationIn the Akira incident, the threat actor used WMI to modify the registry and facilitate lateral movement.T1550.002 · Pass the HashThe article describes pass-the-hash as a possible explanation for disabling Restricted Admin mode on RDP; it does not confirm that this occurred in the incident.T1562.001 · Disable or Modify ToolsThe attacker attempted to disable Microsoft Defender after it blocked an initial ransomware deployment attempt.
Threat Actors
AkiraNamed as a ransomware group; an Akira ransomware incident involved rapid activity before deployment.Black BastaNamed as a ransomware group; it averaged fewer than 10 pre-deployment actions.ContiNamed as a ransomware group; it averaged fewer than 10 pre-deployment actions.CrysisNamed alongside Dharma among groups with faster ransomware deployment times.DharmaNamed among groups with faster ransomware deployment times.INC RansomIdentified in the report as the ransomware group involved in an incident affecting a healthcare entity.MazeNamed as a ransomware group; it averaged more than 30 pre-deployment actions.PhobosNamed as a ransomware group; it averaged more than 30 pre-deployment actions.PlayNamed as a ransomware group; the report says it deployed quickly and averaged fewer than 10 pre-deployment actions.RansomHubNamed as a ransomware group whose actors may enter an environment knowing how to move quickly.RapidNamed among groups with longer ransomware deployment times.SodinokibiNamed among groups with longer ransomware deployment times.
Malware
Vendors
HuntressIn the Huntress 2025 Cyber Threat Report, we found that the average time-to-ransom across security incidents was almost 17 hours, with ransomware groups taking an average of 18 actions before they actually triggered theMicrosoftAttempting to shut down security tools to avoid detection: The threat actor tried to disable Microsoft Defender after it blocked the initial attempt to deploy the ransomware executable.
Products
Tools
PowerShellAlternate authentication: The threat actor ran a PowerShell command to disable Restricted Admin mode on RDP, which is a mode allowing users to log into remote host servers without transmitting their credentials to theProcDumpAuthority Subsystem Service (LSASS): Here, the threat actor sought to dump LSASS credentials via the ProcDump command-line utility (“C:\ Windows\Temp\Procdump\procdump.exe”)RDPunauthorized account access via stolen credentials or through brute force attacks on Remote Desktop (RDP)Windows Management InstrumentationLateral movement: The threat actor used WMI to modify the registry and facilitate lateral movement across RDP.