Ransomware Response

Ransomware is the most financially destructive threat facing organisations today. The 2024 Verizon DBIR found that ransomware appeared in 24% of all breaches — and the average ransom demand increased to $1.5 million, with the average recovery cost reaching $4.5 million including downtime, remediation, and reputational damage.

Ransomware response is a specialised discipline within incident response. The stakes are high: every minute of encryption spreads the damage, and the decision to pay or not to pay has legal, financial, and ethical implications.

The Ransomware Threat Landscape

Step-by-Step Ransomware Response

    graph TD
    A[Ransomware Detected] --> B[Step 1: Isolate]
    B --> C[Step 2: Identify Strain]
    C --> D[Step 3: Preserve Evidence]
    D --> E[Step 4: Find Patient Zero]
    E --> F[Step 5: Eradicate]
    F --> G{Backups Available?}
    G -->|Yes| H[Step 6: Restore from Clean Backups]
    G -->|No| I[Evaluate Decryption Options]
    I --> J[Consider: Pay or Not Pay?]
    J -->|Pay| K[Negotiate + Purchase Crypto]
    J -->|Not Pay| L[Rebuild from Scratch]
    H --> M[Step 7: Enhance Controls]
    K --> M
    L --> M
  

Step 1: Isolate Affected Systems

Immediate actions (seconds to minutes):

1. EDR isolate all affected hosts immediately
   → Do not wait for scoping — isolate first, investigate second

2. Disable all network shares and mapped drives
   → Prevents encryption of network file servers

3. Block all outbound traffic from affected network segments
   → Prevents C2 communication and further data exfiltration

4. Disable or disconnect backup storage if backups are online
   → Prevents backup encryption (immutable/cold backups unaffected)

5. Notify IR team via out-of-band communication
   → Ransomware may monitor email/Slack — use phone or Signal

CRITICAL: Do not power off systems — volatile evidence (RAM, running processes, active encryption) is needed for analysis and decryption possibilities.

Step 2: Identify the Ransomware Strain

Identifying the strain determines whether a decryptor exists, what the ransom demand will be, and how the ransomware operates:

Method 1: Ransom note

README_TO_DECRYPT.html (LockBit)
How_To_Return_Files.txt (REvil)
DECRYPT_INSTRUCTIONS.html (BlackCat/ALPHV)
!Decrypt-All-Files!.html (Maze)

Method 2: File extension

.encrypted (LockBit)
.locked (REvil)
.[email].mamba (BlackCat)
.[id].crypt (Sodinokibi)

Method 3: Ransomware identification tools

Method 4: Dark web leak site check

Many ransomware operations have public leak sites where they name victims. Check these to confirm the group and see what data has been leaked:

LockBit: http://lockbit[.]org
BlackCat/ALPHV: http://alphv[.]xyz
Cl0p: http://clop[.]su

Step 3: Preserve Evidence

Forensic evidence is critical for understanding the attack, supporting law enforcement, and defending against legal action:

Step 4: Determine Patient Zero and Infection Vector

Understanding how the ransomware entered is essential for eradication and prevention:

Step 5: Eradicate

Remove the ransomware and attacker access from the environment:

1. Remove ransomware binaries and persistence mechanisms
   → Delete scheduled tasks, services, Run keys

2. Terminate active attacker sessions
   → Disable all compromised accounts, reset credentials

3. Remove backdoors and C2 beacons
   → Delete webshells, remote access tools, tunnelling software

4. Patch exploited vulnerabilities
   → Apply patches for the specific CVE or misconfiguration used

5. Change ALL credentials
   → All local admin passwords, service account passwords, domain admin passwords
   → All application credentials and API keys
   → All certificates (replace, not just re-issue)

6. Verify eradication
   → Full EDR scan across the environment
   → Hunt for persistence mechanisms related to the ransomware family
   → Monitor for 48+ hours of no malicious activity

Step 6: Restore from Backups

Restoration is the most critical phase for business continuity. The quality of your backup strategy determines whether you recover quickly or face extended downtime.

Backup Requirements for Ransomware Resilience:

Restoration Process:

1. Verify backup integrity
   → Check backup catalogs are not corrupted
   → Test restore a single small system first

2. Rebuild clean environment
   → Wipe and reinstall affected systems from known-good media
   → Apply all security patches before reconnecting

3. Restore data
   → Restore from the most recent clean backup (pre-compromise)
   → Scan restored files for malware before moving to production

4. Verify restored data
   → Check data integrity and completeness
   → Test application functionality

5. Reconnect to network
   → Apply least-privilege segmentation
   → Enhanced monitoring for re-infection

Step 7: Enhance Security Controls

Post-incident hardening to prevent recurrence:

Case Study: Colonial Pipeline

The Colonial Pipeline ransomware attack (May 2021) is the most significant ransomware incident in US history. The attack disrupted fuel supply across the US East Coast for 6 days and led to the payment of a $4.4 million ransom.

Timeline

Root Cause Analysis

Ransom Payment Decision

The Colonial Pipeline decision to pay the ransom was driven by:

1. Operational necessity — The pipeline shutdown was creating a national fuel emergency
2. Backup limitation — Online backups were encrypted; offline backups would take weeks to restore
3. Insurance guidance — Cyber insurance policy covered ransomware payments
4. Law enforcement involvement — FBI was notified and did not advise against payment (the FBI’s official stance is not to pay, but they recognised the operational pressure)

The ransom was paid to a wallet that was later identified and partially recovered by the FBI. This was a rare success in crypto recovery — most ransomware payments are not recovered.

Post-Incident Changes

The Colonial Pipeline attack drove industry-wide changes:

• TSA Security Directive (May 2021) — Mandatory ransomware controls for pipeline operators
• Cyber Incident Reporting for Critical Infrastructure Act (March 2022) — Mandatory 72-hour breach reporting
• Increased cyber insurance requirements — Insurers now require MFA, EDR, offline backups for ransomware coverage
• SEC breach disclosure rules (2023) — Public companies must disclose material cybersecurity incidents within 4 business days

To Pay or Not to Pay?

The ransom payment decision is one of the most difficult an organisation can face:

Key Takeaways

• Ransomware response follows seven steps: Isolate → Identify Strain → Preserve Evidence → Find Patient Zero → Eradicate → Restore → Enhance Controls
• The first action is always isolation — every minute of spread increases recovery cost and complexity
• Identifying the ransomware strain determines whether a decryptor exists and informs the response strategy
• Backup strategy is the single most important determinant of ransomware resilience — 3-2-1, immutable, air-gapped, and tested
• The Colonial Pipeline attack demonstrated that MFA, network segmentation, and offline backups are non-negotiable for critical infrastructure
• The ransom payment decision has security, legal, financial, and ethical dimensions — never make it alone, and always document the reasoning