Ransomware attacks are conducted over time, ranging from a day to a month, starting with a ransomware operator breaching a network. These attacks are carried out by a hacker who steals unencrypted files from backup devices and servers before deploying the ransomware. In some attacks, the threat actors were reading victim’s emails even as ransomware negotiations were taking place. McAfee’s John Fokker and Vitali Kremez, Chairman of Advanced Intel, also offered some additional advice and strategies that should be taken to remediate an attack properly.
Source: https://www.bleepingcomputer.com/news/security/ransomware-operators-lurk-on-your-network-after-their-attack/