A SOC analyst reviews an endpoint alert showing a user process rapidly reading, encrypting, and rewriting thousands of files across mapped network drives, followed by the creation of a text file named 'RECOVER_YOUR_FILES.txt' in every affected directory. The Volume Shadow Copy service was also stopped just before the encryption began. Which type of endpoint-based attack does this behavior most clearly indicate?