Essentials for Ransomware Incident  Response

1. Technical Containment and Damage Limitation

The absolute priority upon detecting a ransomware attack is to stop the encryption from spreading. The hacker or their automated malware will actively attempt to traverse the organisations network to spread the damage as widely as possible and backup systems.

​

The Incident Response Team (IRT) must quickly identify and isolate infected systems by disconnecting them from the local network and the internet. This includes disabling Wi-Fi, cutting local area network (LAN) connections, and shutting down any external access.  Following this all admin and privileged accounts should have passwords and other access credentials changed, Systems should stay “live” in this isolated environment to facilitate forensic investigation and root cause analysis.

2. Activating Business Continuity and Out-of-Band Communication

With operationally critical data encrypted, standard business functions will quickly grind to a halt. Organisations must immediately activate their Business Continuity Plan (BCP) to maintain baseline operations through pre-defined manual or alternative processes, where possible. This might involve reverting to paper-based logging, utilising independent cellular networks, or deploying pre-configured standalone workstations.

​

Primary email servers and other collaborative environments may be compromised or monitored by the attacker, so the crisis management team must communicate via secure, independent platforms. Social media platforms are often used as fallback communications platforms in these situations.

3. Forensic Investigation and Backup Integrity Verification

The organisation must understand the scope of the compromise and verify the safety of its intended remediation path. Forensic investigators must answer two critical questions: How did the attackers get in? and are our backups safe?

​

Ransomware attacks routinely target backup systems first to eliminate recovery capability. The integrity of the backup infrastructure (including immutable storage, cloud archives, and offline tapes) must be assured to confirm that they have not been compromised in any way. Additionally, the root cause of the initial entry must be identified and remediated. Restoring data into an environment where the attacker still maintains persistent access will simply trigger a secondary encryption cycle.

4.  Legal, Financial, and Ethical Factors

Deciding whether to negotiate with or pay a ransomware actor is a complex, high-stakes decision requiring input from executive leadership, legal counsel, and specialised negotiators.

​

From a legal perspective, payments must comply with international sanctions regimes as payments to sanctioned states, terrorist groups, or designated cybercriminal syndicate can result in significant criminal penalties.

​

Also paying the ransom provides no guarantee of recovery. Many organisations that pay fail to recover all their data or receive poorly coded decryption tools that that fail to completely restore data. Paying a ransom demand will also label the organisation as a soft target, significantly increasing the likelihood of a further attack.

5. Restoration & Compliance

Once a clean recovery environment is established, the data restoration process can commence. This must be done using a pre-defined, tested approach, focussing priority systems and services. Every file and virtual machine restored from backups must be aggressively scanned and sanitised to ensure no malware is reintroduced.

Finally, the organisation must address its legal reporting obligations. Ransomware attacks often involve double extortion, where sensitive data is exfiltrated sensitive data prior to encrypting it. If personal data has been compromised or stolen, strict regulatory reporting windows will apply.  See data breach incident response essentials for specific issues to be addressed in these circumstances