Staff arrive in the morning to find file extensions changed and a ransom note on their screens. At this moment, hasty decisions such as formatting servers, running unknown decryption tools or connecting a backup drive can multiply the damage. A plan written in advance is the difference between a few days of downtime and weeks of crisis.
Before the Crisis: Write the Plan Now
- An emergency contact list: the IT manager, the CEO, the legal advisor and the security and network contractor.
- A list of critical systems and the order in which to restore them.
- A printed or offline copy of the plan, the network diagram and emergency passwords, because servers and email may be unavailable.
- An alternative communication channel, such as phone calls or a messaging group, for when company email is down or cannot be trusted.
The First Hour: Containment
- Disconnect infected devices from the network. Unplug network cables, turn off Wi-Fi and, if needed, block internet access and branch VPN tunnels on the firewall so the infection does not spread.
- Do not rush to shut down and wipe. As far as possible, keep devices powered on but disconnected from the network; the data in memory is valuable for investigating the attack. If isolation is not possible and encryption is still running, shutting down is the next option.
- Save the backups. Disconnect backup storage from the network and do not connect any backup disk to an infected system.
- Record the evidence. Photograph the ransom note, file extensions and error messages, and note the time you saw them.
- Lock down access from a clean device. Disable suspicious accounts and change admin account passwords.
Write down everything you do at this stage, with the exact time. This record is essential for the investigation team, for the authorities and for preventing a repeat attack.
Assessing the Scope of the Attack
After containment, you need to establish what has been affected: which servers, computers and virtualization hosts are involved, whether the backups are intact, and whether there are signs of data exfiltration. The ransomware family can usually be identified from the text of the note and the file extensions. Legitimate decryption tools have been published for some ransomware families, but only run them from official sources and with expert advice.
Communication and Management Decisions
Management needs to be informed early, because key decisions are made at the business level: when and how to inform staff, customers and partners, and how to report the incident to the relevant authorities, such as the police cybercrime unit. Paying the ransom is a business and legal decision that should not be made in haste; payment offers no guarantee that data will be returned or not published, and it must be reviewed with security experts, legal counsel and the relevant authorities.
Recovery: Clean Up Before Going Back
- Find and close the entry point. If the cause, such as open RDP or a leaked password, is not fixed, the attack will happen again.
- Rebuild systems or restore them from a clean backup, rather than just deleting infected files.
- Check backup dates. The attacker may have been on the network for some time before encryption; restore and inspect backups in an isolated environment before connecting them to the network.
- Restore in order of priority: Usually infrastructure first, meaning the domain and DNS, then finance and operations servers, and finally the remaining systems.
- Change every password, from user accounts to service accounts and network equipment.
After the Incident
Once operations are back to normal, review the incident: where the attack started, what worked well and what needs to change. Keep network monitoring tighter for several weeks as well, so any sign of the attacker returning is caught.
Checklist
- The response plan, contact list and an offline copy are ready.
- Everyone knows the first step is disconnecting the device from the network.
- An offline or immutable backup exists.
- The person responsible for decisions and communication is defined.
- The recovery order for systems has been set in advance.
Whether you want a response plan ready before a crisis or you are facing an incident now, ITPlus724 engineers can support you with drafting the plan, containment and recovery.