Ransomware attack simulator

Watch a ransomware attack play out, then stop it

It starts with one ordinary email. Switch protections on and off, run the attack one step at a time, and see where it gets stopped, or how it ends when nothing stops it.

This page is written for owners, operations leaders and office managers at businesses of roughly 30 to 100 people, not for IT people. No jargon is needed to use it. If you have ever wondered what your IT provider actually protects you from, or what you would be paying for if you hired one, start here.

01
Pick your protections
The switches at the top of the demo are the protections a business might have. Leave them all off the first time so you can see the whole story.
02
Run the attack
Press Run the attack, then Next step, or Play to watch it unfold. The map shows how far the attacker gets, and the screen shows what your team would actually see.
03
Change one thing and run it again
Turn on a single protection and watch where the attack stops. Then try Backups on its own and see how the ending changes.

1. Choose your protections

2. Watch the attack

What the screen shows

Monday, 9:04 AM

An ordinary Monday.

Choose your protections above, then run the attack.

Scenario: The fake invoice

Five steps from an ordinary email to locked files.

Press Run the attack to take the first step, or Play to watch it unfold. You can go back at any point.

Tip: once a control has focus, the left and right arrow keys step through the attack.

A simplified story. Real attacks vary, and no single tool stops everything.

What is actually going on

Why do businesses of 30 to 100 people get hit by ransomware?

Most attacks on businesses of 30 to 100 people are not personal. Nobody sat down and decided to go after your company in particular. The people behind them send the same fake invoice to thousands of inboxes and wait to see who clicks. Your business ends up on the list because it has email addresses, bank accounts and files it cannot work without.

Companies this size sit in an awkward middle. There is real money moving through accounts payable and payroll, dozens of inboxes that could each be the way in, and a file server or shared drive every department depends on. But there is usually no one on staff whose whole job is watching for attacks, and the person who handles IT is often doing it alongside something else.

It helps to think of it as a business, because that is how the attackers run it. Some groups specialize in the emails. Others buy the passwords those emails collect. Others specialize in getting inside a network and locking it up. Each one is paid when the next one succeeds. That is why a single click on a Monday can turn into locked files on a Wednesday: the work gets handed from one specialist to the next.

The goal is almost always money, and it usually arrives in one of three ways: locking your files and demanding payment to unlock them, stealing data and threatening to publish it, or quietly changing the bank details on an invoice so that a real payment goes to the wrong account.

The good news is that every one of those paths has several steps, and every step is a chance to stop it. You do not need to be a technical person to understand those steps, and you do not need to do the technical work yourself. You do need to know which protections cover which step, so you can ask the right questions of whoever looks after your computers.

The five steps, in plain English

What are the five steps of a ransomware attack?

A typical ransomware attack moves through five steps: the email, the login, the foothold, the spread and the lock. Each step below shows what the attacker does, what you would notice, what stops it, and one question worth asking whoever looks after your computers.

Step 1
The email
What happens
An email arrives that looks like it comes from someone you already do business with: a supplier, your accountant, a delivery company, even your own bank. It asks you to open an invoice, confirm a payment or check a document. The name looks right. The logo looks right. The tone is friendly and a little urgent.
What you would notice
It looks like every other Monday email. The only clues are small: an address that is one letter off, a link that points somewhere unexpected when you hover over it, or a request that is slightly out of the ordinary.
What stops it
Email filtering checks every incoming message before it reaches anyone. It looks at where the message really came from, whether the links point to known bad sites, and whether attachments behave strangely when opened in a safe space. Suspicious messages are held in quarantine so nobody has to make a judgment call.
Ask your IT provider
Do we have email filtering beyond the basic spam folder, and who reviews what it quarantines?
Step 2
The login
What happens
The link opens a page that looks exactly like the Microsoft 365 sign-in page your team uses every day. The employee types their email and password, and the page says something went wrong. Behind the scenes, the password has just been sent to the attacker.
What you would notice
Almost nothing. The employee assumes it was a glitch, signs in again on the real page and gets on with their day. Nobody knows the password has been taken.
What stops it
Multi-factor authentication asks for a second proof at sign-in, usually a code or an approval on the employee’s phone. The attacker has the password but not the phone, so the stolen password on its own does not get them in. Stronger setups also block sign-ins from unexpected places or unmanaged devices.
Ask your IT provider
Is multi-factor authentication turned on for every account, including shared mailboxes, admin accounts and the owner’s account?
Step 3
The foothold
What happens
Signed in as the employee, the attacker reads their email, learns who they talk to and uses the real account to send a file to a coworker. The coworker trusts the sender and opens it. A small program starts running quietly on their laptop.
What you would notice
The laptop might feel a little slow. There may be nothing at all. The program is designed to stay out of sight while it gives the attacker a way back in.
What stops it
Endpoint protection watches what programs on each computer actually do, not just their names. When something starts behaving like an attack, such as reaching for passwords or trying to spread, it is stopped and the laptop can be cut off from the network until someone looks at it.
Ask your IT provider
What watches each computer for suspicious behavior, and can a laptop be cut off from the network remotely if something goes wrong?
Step 4
The spread
What happens
Now the attacker works from that one laptop outward. They look for the file server, the accounting system, the backups and any account with more access. They usually do this at night or over a weekend, when nobody is looking.
What you would notice
You are at home. The office is dark. Unless someone is watching, the first sign of trouble is often the next step.
What stops it
24/7 monitoring means people are reviewing alerts around the clock, including nights and weekends. Unusual activity, such as an account signing in to machines it never touches or large amounts of data moving at 3am, gets looked at by a person who can lock accounts and isolate machines before the damage is done.
Ask your IT provider
If something suspicious happens at 2am on a Saturday, who sees it, and what are they allowed to do about it without waiting for us?
Step 5
The lock
What happens
The attacker runs the program that scrambles your files so they cannot be opened. A message appears on every screen explaining how to pay to get them back. Often the attacker has also copied files first and threatens to publish them.
What you would notice
Monday morning. Nobody can open a file. The phones are ringing. This is the step every owner imagines, and by the time you see it, the other four steps have already happened.
What stops it
In this story, nothing stops this step once the attacker gets here. What matters now is whether you have backups the attacker could not reach. That decides whether you restore and get back to work, or face the choice between paying and rebuilding.
Ask your IT provider
If every computer and server were locked tomorrow, what exactly would we restore from, and how long would it take?

Three stories

How does the same attack end differently?

The same attack ends differently depending on which protections are in place. These are composite stories, built from common patterns to show how the steps play out. They are not about any real business.

Story one

The Friday invoice

A dental group with three offices and about 40 staff pays every vendor from one central mailbox. Late on a Friday, the accounts payable coordinator gets an email that looks like it is from the supplier all three offices use, saying an invoice is overdue. She clicks the link and signs in on what looks like the usual Microsoft page. It shows an error, so she tries the real site and heads home.

On Saturday, someone in another country tries to sign in to her mailbox with the password they collected. Her phone buzzes with a sign-in request she did not start. She taps Deny and calls the group’s IT provider, who resets the password and checks the account before Monday.

The attack reached step two and stopped there. Had it worked, the attacker would have been sitting inside the one mailbox that pays every vendor for every office.

Multi-factor authentication did not stop the email or the click. It made the stolen password useless. At 30 to 100 people, one mailbox can touch every vendor you pay, so tell your team: a sign-in request you did not start is an alarm, not a glitch.

Story two

The 2am login

A 60-person accounting firm is deep in its busiest season. One staff member uses the same password for a shopping site and an old remote access tool the firm set up years ago and forgot about. That shopping site had its passwords stolen months ago, and the attacker simply tries the same email and password on the firm’s tool. It works.

At 2am on a Tuesday, the account that normally signs in from the front desk starts connecting to the file server, then to two partners’ computers, then to the machine that runs the backups. The monitoring team sees an account doing things it has never done, at an hour it never works. They lock the account, isolate the machines it touched and call the managing partner at 6am.

By the time 60 people arrive, the attacker has been cut off. There is cleanup work to do: passwords reset, the old remote tool removed and a close look at what was accessed. But nothing was locked, and the season carries on.

Attackers do not keep office hours. At this size there is rarely anyone on staff watching the network at 2am, so the question is not whether you have alerts. It is whether a person sees them overnight and is allowed to act.

Story three

Two firms, one Monday

Two engineering firms of about 50 people each, in the same office park, are hit by the same kind of attack in the same week. In both, the attacker gets all the way to step five. On Monday morning every file on every computer is locked, project deadlines are days away, and there is a message on each screen asking for payment.

The first firm had a backup drive plugged into the server around the clock. It was convenient, and it was always up to date. It was also connected, so the attacker locked it along with everything else. Fifty people cannot work, and the owners face the choice between paying and hoping, or rebuilding years of project files from email attachments and whatever clients still have.

The second firm’s IT provider kept backups in a separate place the attacker’s access could not reach, and practiced restoring from them. It is still a hard week: machines are wiped and rebuilt, the most urgent project files come back first and teams share a few clean laptops while the rest are rebuilt. But the files come back, the deadlines are met and the firm is working again.

Both firms had backups. Only one had backups that survived the attack. The difference was not the brand of software. It was whether the copy was kept out of reach and whether anyone had tested getting files back for 50 people at once.

The part most owners miss

Do backups stop ransomware?

No. Backups do not stop ransomware; they decide how the attack ends. Email filtering, multi-factor authentication, endpoint protection and monitoring each stop an attack at a different step. Backups work differently. They don't block anything. They are what turns “down for days” into “restored” when everything else has been gotten past.

Most businesses have something they call a backup. The question that matters is whether it would survive the attack in this demo. An attacker who has spent a night moving around your network will look for your backups on purpose, because deleting them is what makes you more likely to pay. A copy that sits on the same network, signed in with the same accounts, is often locked along with everything else.

A backup that will actually save you has five qualities:

Kept out of reach
At least one copy is stored somewhere an attacker cannot reach or change using the same access they would get to your office computers.
Automatic
Backups run on a schedule without anyone remembering to plug in a drive or press a button.
Covers the cloud too
Email, OneDrive, SharePoint and other cloud tools are included. Being in the cloud keeps files available; it does not mean you can get back last Tuesday’s version after they are deleted or locked.
Tested
Someone regularly restores real files and whole systems from the backup to prove it works, and writes down how long it took.
Watched
Someone is told when a backup fails, and fixes it, instead of discovering the gap on the day it is needed.

Common beliefs

What do owners get wrong about ransomware?

“We’re not big enough to be a target.”: Most attacks are automated and sent to huge lists. They are not aimed at big names. A company of 50 people has dozens of inboxes, each one a possible way in, plus payroll, invoices and client files worth holding hostage.
“We have antivirus.”: Traditional antivirus mostly recognizes known bad files. The attack in this demo uses a real password and a real account for the first several steps. There is no bad file to recognize until much later.
“Everything is in Microsoft 365, so it’s backed up.”: Microsoft keeps the service running. Keeping your own restorable copies of your data, going back far enough to undo a mistake or an attack, is generally your responsibility. Check what your setup actually keeps and for how long.
“A strong password is enough.”: A strong password typed into a fake sign-in page is just as stolen as a weak one. That is why the second proof at sign-in matters.
“Our IT person would tell us if something was wrong.”: Only if something is watching, and only if they are awake. Ask what is monitored, when, and by whom.

If it happens to you

What should you do in the first hour of a ransomware attack?

Disconnect, call your IT provider by phone, and do not pay until you have advice. If you arrive to locked files or a ransom message, the first hour matters. Print this list and keep it somewhere you could find it without a computer.

01
Disconnect affected computers from the network. Unplug the network cable or turn off Wi-Fi. Do not shut them down or wipe them; what is on them helps work out what happened.
02
Call your IT provider by phone. If your email may be compromised, do not use it to coordinate the response.
03
Do not pay, and do not reply to the attacker, until you have talked to your IT provider, your cyber insurer if you have one, and legal counsel.
04
Call your cyber insurance provider early. Many policies have a hotline and require you to use their approved responders.
05
Write down what you saw and when: the first odd email, the first locked file, the ransom message. Take photos of screens.
06
Warn your team not to open unexpected files, approve sign-in requests they did not start or send money based on email instructions until you give the all-clear.
07
Report it. In the United States, the FBI takes reports at ic3.gov. Your IT provider or insurer can help you decide who else needs to be told.

Official guidance worth bookmarking: CISA #StopRansomware guidance, CISA on multi-factor authentication, the FBI Internet Crime Complaint Center (IC3).

Plain-English glossary

What do common security terms mean?

Six terms cover most of what an IT provider will say about ransomware. You do not need to learn the jargon, but it helps to recognize it when your IT provider uses it.

Phishing: An email, text or call pretending to be someone you trust so that you click a link, open a file, share a password or send money.
Multi-factor authentication (MFA): A second check at sign-in, such as a code or an approval on your phone, so that a password alone is not enough.
Endpoint: Any computer or device people work on: laptops, desktops, and often phones and servers.
Endpoint protection: Software on each device that watches what programs do and stops ones that behave like an attack.
Monitoring: People and tools reviewing alerts from your systems and responding to them. 24/7 means nights, weekends and holidays too.
Ransomware: A program that scrambles your files so they cannot be opened, followed by a demand for payment to unscramble them.
Backup kept out of reach: A copy of your data stored so that an attacker who gets into your office systems cannot delete or scramble it. You may hear it called offline, isolated or immutable.

Questions

What do business owners ask about ransomware?

Is this demo based on a real attack?

It is a simplified version of a very common pattern: a fake email, a stolen password, a program on one computer, spreading across the network, then locked files. Real attacks vary. Some skip steps, some take weeks, and some steal money directly instead. The steps are close enough to real life to show where each protection fits.

Which protection should a business of 30 to 100 people start with?

Start with multi-factor authentication on every account and with tested backups kept out of reach. Multi-factor authentication is usually quick to turn on and makes stolen passwords far less useful. Backups decide how bad the worst day can get. After that, the right order depends on how your business works, so walk through the five steps with your IT provider.

If I have backups, do I still need the other protections?

Yes. Backups change the ending, but the attack still happens. You still lose time rebuilding machines, your data may still have been copied before it was locked, and you may still have to notify clients. The other protections are what stop the attack before it gets that far.

If I have all four protections, do I still need backups?

Yes. Each protection can be gotten past on a bad day: a new trick in an email, a sign-in approved by mistake, a program nobody has seen before. Backups are also what save you from things that are not attacks at all, like a deleted folder, a failed server or a fire.

Our files are in OneDrive and SharePoint. Aren’t they safe?

Not on their own. Cloud storage keeps files available and is more resilient than a server in a closet. But an attacker signed in as one of your people can delete or scramble cloud files too, and those changes sync. Ask whether you have separate backups of your Microsoft 365 data and how far back they go.

Should we ever pay a ransom?

That is a decision for you, your insurer, your legal counsel and, where relevant, law enforcement, and it should not be made alone in a panic. Paying does not guarantee your files come back or that stolen data is deleted. The best position is to never have to consider it, because your backups make it unnecessary.

How do I know whether my backups actually work?

Ask to see a test restore. A good answer sounds like: we restored these files, or this whole machine, on this date, and it took this long. If nobody can tell you the last time a restore was tested, treat your backups as unproven.

What can my team do, since most of this is technical?

Three habits help at almost every step. Slow down on any email that asks for money, a password or urgent action, and check with the sender another way. Treat any sign-in request you did not start as an alarm. And report anything odd to IT right away, even if it feels minor. Early reports turn a bad week into a non-event.

Where can an Orange County business get help checking its ransomware protection?

BRITECITY is a managed IT provider based in Irvine that works with businesses across Orange County, including Irvine, Newport Beach and Costa Mesa. The free IT Health Check is a low-effort first step: it shows which of the protections in this simulator are in place and where the gaps are.

How does the free IT Health Check relate to this?

The demo shows where protections fit in general. The IT Health Check looks at your business from the outside, including things like how your email is set up, and shows where the gaps are. It is a practical next step if you want to know which of the switches in this demo are on for you.

Keep going

Where to go next

The simulator shows the pattern. These pages go deeper on each part of it.

Which of these does your business have?

The free IT Health Check looks at your setup and shows you where the gaps are. It is a practical way to find out which switches in this demo are on for you.

Start Your IT Health Check Book a 30-minute call

Watch a ransomware attack play out, then stop it

It starts with one ordinary email. Switch protections on and off, run the attack one step at a time, and see where it gets stopped, or how it ends when nothing stops it.

Do backups stop ransomware?

Watch a ransomware attack play out, then stop it

Pick your protections

Run the attack

Change one thing and run it again

Why do businesses of 30 to 100 people get hit by ransomware?

What are the five steps of a ransomware attack?

The email

What happens

What you would notice

What stops it

Ask your IT provider

The login

What happens

What you would notice

What stops it

Ask your IT provider

The foothold

What happens

What you would notice

What stops it

Ask your IT provider

The spread

What happens

What you would notice

What stops it

Ask your IT provider

The lock

What happens

What you would notice

What stops it

Ask your IT provider

How does the same attack end differently?

The Friday invoice

The 2am login

Two firms, one Monday

Do backups stop ransomware?

Kept out of reach

Automatic

Covers the cloud too

Tested

Watched

What do owners get wrong about ransomware?

What should you do in the first hour of a ransomware attack?

What do common security terms mean?

What do business owners ask about ransomware?

Where to go next

Which of these does your business have?

Watch a ransomware attack play out, then stop it

Pick your protections

Run the attack

Change one thing and run it again

Why do businesses of 30 to 100 people get hit by ransomware?

What are the five steps of a ransomware attack?

The email

What happens

What you would notice

What stops it

Ask your IT provider

The login

What happens

What you would notice

What stops it

Ask your IT provider

The foothold

What happens

What you would notice

What stops it

Ask your IT provider

The spread

What happens

What you would notice

What stops it

Ask your IT provider

The lock

What happens

What you would notice

What stops it

Ask your IT provider

How does the same attack end differently?

The Friday invoice