Ransomware: how to spot the attack before your files are encrypted

Updated 11 October 2026 · 5 min read · By Anders Karlsson

When the screen shows a ransom demand, the attack is already over. Encryption is the last step in a sequence that has often been going on for hours or days. This guide goes through the steps, which signs you can spot along the way and what to do if it happens.

Small businesses are hit most often

Ransomware was present in 44 per cent of all data breaches that Verizon analysed in its 2025 report, and in 88 per cent of breaches at small and medium-sized businesses.
Among companies with 100–250 employees, only 34 per cent managed to stop the attack before data was encrypted, according to Sophos's 2026 survey.
In Sweden, 3 per cent of companies with 1–49 employees say they have been hit by ransomware in the past year, according to a 2025 survey by the Swedish Theft Prevention Association (SSF).

Small businesses are not more interesting targets than large ones. They just more often have stolen passwords that work, equipment that is not updated and nobody watching the alerts.

The attack step by step

Intrusion. The most common routes are phishing, stolen passwords for email, VPN or remote desktop, and vulnerabilities in equipment reachable from the internet, for example firewalls and VPN servers that have not been updated.
Reconnaissance. The attacker explores the network: which computers and servers exist, which file shares, which user accounts and where the backups are kept. Port scans and ordinary administration tools are often used here.
Higher privileges. The attacker collects passwords from the first computer or creates their own administrator account.
Spreading. With administrator privileges, the attacker moves on to servers and other computers, often via remote desktop or remote control software.
Data theft. Sensitive files are copied out. The attacker can then threaten to publish them even if you can restore from backup.
Defences are knocked out. Backups are deleted, antivirus is switched off and Windows shadow copies are removed.
Encryption. The files are encrypted, preferably at night or over a weekend when nobody is around.

Steps 2–6 are your chance. The earlier you detect the attack, the less the attacker has time to do.

Signs to look out for

Sign	Where it shows up
Someone is scanning the network	A honeypot raises an alert immediately. Otherwise it is rarely visible without dedicated monitoring.
New administrator accounts	The user list in Microsoft 365, Google Workspace or Active Directory
Logins at odd hours or from other countries	Sign-in logs and warning emails from Microsoft or Google
Antivirus switched off or raising alerts	The antivirus console and warnings on the computers
Backups failing or copies missing	Reports from the backup software
New remote control software, for example AnyDesk	The list of installed programs
Unusually high outbound traffic from the network	The router's or firewall's statistics

Many of the signs only show up if someone is looking. Make sure warning emails from Microsoft, Google and the backup software go to an address that is actually read, and that the most important alerts reach a mobile phone.

How to get there first

Multi-factor authentication (MFA) everywhere, above all on email, VPN and remote access. It stops most intrusions that rely on stolen passwords.
Update internet-facing equipment first: firewall, VPN and remote desktop. Close remote desktop (RDP) to the internet entirely if you can.
Backups the attacker cannot delete. At least one copy should be offline or immutable, and restores should be tested regularly.
Antivirus with alerts that someone reads. Microsoft Defender is included in Windows and goes a long way if the warnings are actually monitored.
Detection inside the network. A honeypot raises an alert during reconnaissance, step 2 above, long before encryption. See our guide to honeypots.
A one-page plan: who do you call, where are the backups, which customers and authorities need to be informed.

If it happens

Disconnect affected computers from the network. Unplug the network cable and turn off Wi-Fi. Do not shut the computers down if you can avoid it, because traces in memory are then lost.
Contact your IT partner or an incident response service immediately, even at the weekend.
Change passwords for administrator accounts and email, from a computer that has not been affected.
Report the attack to the police.
Notify the Swedish Authority for Privacy Protection (IMY) within 72 hours if personal data may have been compromised, which is almost always the case.
If you are covered by the Swedish Cybersecurity Act (cybersäkerhetslagen, NIS2), an early warning must be submitted to Myndigheten för civilt försvar (MCF), the Swedish civil defence agency, within 24 hours. Read more in the guide NIS2 for small suppliers.
Do not pay without getting advice. There is no guarantee that the files can be restored or that stolen data will be deleted.

Frequently Asked Questions

How does ransomware get into a small business?

Usually through phishing, stolen passwords for email or remote access without multi-factor authentication, or through vulnerabilities in firewalls and VPN servers that have not been updated.

How long does an attack take?

It varies from a few hours to several weeks. Sophos's investigations show that the attacker reached the company's user directory a median of roughly 11 hours after the intrusion.

Does cloud storage protect against ransomware?

Partly. Synchronised folders such as OneDrive and Dropbox can be encrypted just like local files, but they often have version history that allows the files to be restored. It does not replace a backup that the attacker cannot reach.

Should we pay the ransom?

Do not make that decision alone. There is no guarantee you will get the files back, and the payment funds the next attack. Get help from an incident response service and the police first.