From initial compromise to ransomware and wipers