Performing Ransomware Response

When to Use

• Ransomware has been detected executing or file encryption is actively occurring
• Users report inability to open files with unfamiliar extensions appended
• A ransom note is discovered on one or more systems
• EDR detects mass file modification patterns consistent with encryption behavior
• Threat intelligence warns of an imminent ransomware campaign targeting the organization

Do not use for general malware incidents that do not involve file encryption or extortion; use malware incident response procedures instead.

Prerequisites

• Ransomware-specific incident response playbook reviewed and approved by executive leadership
• Tested and verified offline backup strategy with air-gapped or immutable copies
• Incident retainer with a specialized ransomware response firm (e.g., Mandiant, CrowdStrike Services, Kroll)
• Legal counsel pre-engaged for OFAC sanctions screening and regulatory notification
• Cyber insurance carrier contact information and policy coverage details
• Bitcoin/cryptocurrency analysis capability or third-party engagement for payment tracing

Workflow

Step 1: Detect and Confirm Ransomware

Validate that the incident is ransomware and determine the variant:

• Identify the ransomware by analyzing the ransom note filename, extension appended to encrypted files, and note content
• Upload the ransom note and a sample encrypted file to ID Ransomware (id-ransomware.malwarehunterteam.com)
• Check NoMoreRansom.org for available free decryptors
• Determine the ransomware deployment method from EDR/SIEM logs
• Identify the ransomware group (e.g., LockBit, BlackCat/ALPHV, Royal, Akira, Play)

Ransomware Identification:
━━━━━━━━━━━━━━━━━━━━━━━━━
Variant:          LockBit 3.0 (Black)
Extension:        .lockbit3
Ransom Note:      README-LOCKBIT.txt
Tor Site:         lockbit[redacted].onion
Deployment:       Group Policy Object pushing ransomware.exe to all domain-joined systems
Initial Access:   VPN credential compromise (no MFA)
Dwell Time:       12 days
Data Exfiltration: Yes - 47GB uploaded to MEGA via rclone prior to encryption

Step 2: Immediate Containment

Stop ransomware propagation before assessing damage:

• Priority 1: Disconnect affected network segments from core infrastructure (pull the network cable, not shutdown)
• Priority 2: Isolate all domain controllers immediately if GPO-based deployment is suspected
• Priority 3: Disable the compromised accounts used for deployment
• Priority 4: Block lateral movement protocols (SMB TCP/445, RDP TCP/3389, WinRM TCP/5985-5986)
• Priority 5: Preserve at least one encrypted system live (do not power off) for memory forensics
• Do NOT: Shut down encrypted systems; keep them powered on to preserve encryption keys in memory

Step 3: Assess Damage and Scope

Quantify the impact to inform recovery and business decisions:

• Count the number of encrypted systems (workstations, servers, domain controllers)
• Determine which business-critical systems and data are affected
• Verify backup integrity: check that backups were not encrypted, deleted, or corrupted
• Assess whether data exfiltration occurred (check for rclone, WinSCP, MEGA, cloud storage activity)
• Determine the ransom demand amount and payment deadline
• Check OFAC sanctions lists to verify the ransomware group is not a sanctioned entity (paying is legally risky)

Impact Assessment:
Encrypted Systems:      187 of 340 endpoints (55%)
Encrypted Servers:      12 of 28 (43%) - includes 2 file servers, 1 database server
Domain Controllers:     2 of 3 encrypted
Backup Status:          Veeam repository intact (offline copy verified clean)
Data Exfiltration:      Confirmed - 47GB to MEGA (file listing under analysis)
Ransom Demand:          $2.5M in Bitcoin (72-hour deadline)
OFAC Screening:         LockBit - not currently sanctioned entity (verify with counsel)

Step 4: Recovery Decision Matrix

Evaluate recovery options in consultation with legal, executive leadership, and cyber insurance:

…