MSRXPlaybooks / Ransomware
Ransomware: the first hour
Files are encrypted, there is a ransom note, or several machines suddenly cannot open documents.
Use this when you see encrypted files, renamed extensions or a ransom note. Do not pay or reply yet.
Contain (minutes 0 to 15)
- Disconnect affected machines from the network: pull the cable and turn off Wi-Fi. Do not shut down or reboot unless you cannot isolate them; memory can hold evidence and sometimes decryption keys.
- Disable shared drives, VPN and remote access, and isolate backup systems from the network so they cannot be encrypted too.
- Do not use the infected machines or the domain admin account to investigate.
Assess (minutes 15 to 60)
- Photograph the ransom note and note the file extension. Do not click anything in it.
- Work out the scope: which machines, which shares, since when. Identify the first one affected; it is probably where the attacker came in.
- Check that backups exist and are clean and offline. Do not restore until the attacker is out, or they will encrypt it again.
- Call your IT provider, your cyber insurer if you have one, and a professional incident-response firm.
Recover
- Rebuild affected machines from clean images, reset every credential (especially admin and service accounts), and restore data from clean backups.
- Find and close the way in: commonly an exposed remote desktop, an unpatched VPN or firewall (check the Exploited vulnerabilities list for your vendors), or a phished account.
- Check the free No More Ransom project (nomoreransom.org) for a decryptor before considering anything else. Paying funds crime and does not guarantee recovery.
India: report to CERT-In within 6 hours at incident@cert-in.org.in and file at cybercrime.gov.in. If personal data was affected, see the DPDP section of the India pack.
General guidance, not legal or forensic advice. For a serious incident, involve a professional incident-response firm.