Ransomware attacks most likely to strike after-hours
Researchers identify patterns of commonality, including attack vector, dwell time and the time of strike


Three-quarters of ransomware attacks are launched during the weekend or after work on a weekday, as attackers aim to maximise the potential for devastation and slow down any attempts at mitigation.
Just under half of all ransomware attacks, 49%, are launched on weekdays after 6pm while just 24% occur during work hours and 27% on weekends, according to findings by Fire Eye.
RELATED RESOURCE
The essential guide to cloud-based backup and disaster recovery
Support business continuity by building a holistic emergency plan
The most common hour for ransomware attacks to strike organisations is 11pm, at a time where workers least likely to be able to respond instantaneously.
Organisations from various sectors have been struck with ransomware attacks on an increasing basis in recent months and years, with attacks on UK businesses soaring 195% in the first half of 2019, for example.
“Ransomware is a remote, digital shakedown. It is disruptive and expensive, and it affects all kinds of organizations, from cutting edge space technology firms, to the wool industry, to industrial environments,” said Fire Eye’s intelligent analysis manager Kelli Vanderlee.
“Infections have forced hospitals to turn away patients and law enforcement to drop cases against drug dealers.”
How to keep your files safe from ransomware The most popular ransomware strains targeting UK businesses Ransomware attacks on UK businesses soar 195% Travelex disruption caused by devastating ransomware attack
High profile examples include the devastating Travelex disruption, as well as institutions in several US states, including Louisiana, and towns in Florida, and other states.
Sign up today and you will receive a free copy of our Future Focus 2025 report - the leading guidance on AI, cybersecurity and other IT challenges as per 700+ senior executives
This breed of attack, according to an examination of dozens of incident response investigations between 2017 and 2019, share several common characteristics, including attack vector, dwell time, and time and day of deployment.
There were several initial infection vectors spotted across multiple incidents, with remote access and remote desktop protocol (RDP) the most frequently observed. Other methods include phishing with a link or attachment and drive-by-download.
Another observation was that attackers normally leave at least three days between the first sign of malicious activity and deploying ransomware. In 75% of cases, this period is three days until the payload is deployed.
Among the key findings was that few attacks are launched during work hours, relative to after-work hours and weekends.
“Some attackers possibly intentionally deploy ransomware after hours, on weekends, or during holidays, to maximize the potential effectiveness of the operation on the assumption that any remediation efforts will be implemented more slowly than they would be during normal work hours,” Vanderlee continued.
“In other cases, attackers linked ransomware deployment to user actions. For example, in 2019 incidents at retail and professional services firms, attackers created an Active Directory Group Policy Object to trigger ransomware execution based on user log on and log off.”
Organisations seeking to mitigate or prevent ransomware infections have been given an array of measures they can take, many of which are now deemed common sense such as implementing multi-factor authentication (MFA).
Fire Eye has also urged organisations to establish emergency plans to ensure after-hours coverage is available to respond within a set time period in case of an emergency. After-hours escalation plans should also include redundant means to contact stakeholders, and 24-hour emergency contact information for any relevant third-party vendors.

Keumars Afifi-Sabet is a writer and editor that specialises in public sector, cyber security, and cloud computing. He first joined ITPro as a staff writer in April 2018 and eventually became its Features Editor. Although a regular contributor to other tech sites in the past, these days you will find Keumars on LiveScience, where he runs its Technology section.
-
How to implement a four-day week in tech
In-depth More companies are switching to a four-day week as they look to balance employee well-being with productivity
-
Intelligence sharing: The boost for businesses
In-depth Intelligence sharing with peers is essential if critical sectors are to be protected
-
Hackers breached a 158 year old company by guessing an employee password – experts say it’s a ‘pertinent reminder’ of the devastating impact of cyber crime
News A Panorama documentary exposed hackers' techniques and talked to the teams trying to tackle them
-
The ransomware boom shows no signs of letting up – and these groups are causing the most chaos
News Thousands of ransomware cases have already been posted on the dark web this year
-
Everything we know about the Ingram Micro cyber attack so far
News A cyber attack on Ingram Micro severely disrupted operations and has been claimed by the SafePay ransomware group.
-
A prolific ransomware group says it’s shutting down and giving out free decryption keys to victims – but cyber experts warn it's not exactly a 'gesture of goodwill'
News The Hunters International ransomware group is rebranding and switching tactics
-
Swiss government data published following supply chain attack – here’s what we know about the culprits
News Radix, a non-profit organization in the health promotion sector, supplies a number of federal offices, whose data has apparently been accessed.
-
Ransomware victims are getting better at haggling with hackers
News While nearly half of companies paid a ransom to get their data back last year, victims are taking an increasingly hard line with hackers to strike fair deals.
-
LockBit data dump reveals a treasure trove of intel on the notorious hacker group
News An analysis of May's SQL database dump shows how much LockBit was really making
-
‘I take pleasure in thinking I can rid society of at least some of them’: A cyber vigilante is dumping information on notorious ransomware criminals – and security experts say police will be keeping close tabs
News An anonymous whistleblower has released large amounts of data allegedly linked to the ransomware gangs