Jakarta. Ransomware attacks can begin long before victims discover that their files have been locked, as hackers may spend time stealing passwords, accessing other computers and weakening security defenses before demanding a ransom, cybersecurity firm ITSEC Asia (IDX: CYBR) says.

In a new research paper titled From Sample to Signal: Uncovering the GodDamn Ransomware Operation, the Jakarta-listed company examines how the GodDamn ransomware operates and identifies warning signs that organizations can look for before an attack disrupts their operations.

The research found that attackers may first gain access to a computer, steal login credentials and search for other devices connected to the same network. They can then use compromised accounts to move between computers and servers before deploying ransomware to lock files.

In one incident examined in the study, at least 10 computers or other network-connected systems had been affected before the ransomware was deployed.

This means that by the time employees see a ransom note or find that their files are inaccessible, attackers may already have gained access to multiple systems.

“Ransomware often becomes visible only after files have been encrypted and business operations are already being disrupted,” ITSEC Asia President Director Patrick Dannacher said in a statement.

He said organizations needed to identify suspicious activity earlier to give security teams time to respond before the damage spreads.

The research identifies potential warning signs, including unusual attempts to access other computers, suspicious changes to system settings, rapid changes to large numbers of files and attempts to interfere with security software.

Such activity does not automatically indicate a cyberattack, as some actions may also occur during routine IT operations. However, several unusual activities occurring together could signal a possible intrusion.

The paper also examines reports that attackers used PoisonX, a malicious computer program designed to interfere with security software before files are encrypted. ITSEC Asia classified this finding as based on external reporting because its researchers did not independently examine the program's code.

Based on its findings, the company recommends that organizations monitor activity across computers, employee accounts and networks, while protecting backup systems so they can recover data if an attack succeeds.

Dannacher said businesses needed to look beyond individual malicious files and recognize suspicious behavior across their networks.

The research is based on technical evidence and information available through Aug. 10, 2026.

Add as a preferred source on Google +