Performing Ransomware Response

Performing Ransomware Response

When to Use

• Ransomware has been detected executing or file encryption is actively occurring
• Users report inability to open files with unfamiliar extensions appended
• A ransom note is discovered on one or more systems
• EDR detects mass file modification patterns consistent with encryption behavior
• Threat intelligence warns of an imminent ransomware campaign targeting the organization

Do not use for general malware incidents that do not involve file encryption or extortion; use malware incident response procedures instead.

Prerequisites

• Ransomware-specific incident response playbook reviewed and approved by executive leadership
• Tested and verified offline backup strategy with air-gapped or immutable copies
• Incident retainer with a specialized ransomware response firm (e.g., Mandiant, CrowdStrike Services, Kroll)
• Legal counsel pre-engaged for OFAC sanctions screening and regulatory notification
• Cyber insurance carrier contact information and policy coverage details
• Bitcoin/cryptocurrency analysis capability or third-party engagement for payment tracing

Workflow

Step 1: Detect and Confirm Ransomware

Validate that the incident is ransomware and determine the variant:

• Identify the ransomware by analyzing the ransom note filename, extension appended to encrypted files, and note content
• Upload the ransom note and a sample encrypted file to ID Ransomware (id-ransomware.malwarehunterteam.com)
• Check NoMoreRansom.org for available free decryptors
• Determine the ransomware deployment method from EDR/SIEM logs
• Identify the ransomware group (e.g., LockBit, BlackCat/ALPHV, Royal, Akira, Play)

Ransomware Identification:
━━━━━━━━━━━━━━━━━━━━━━━━━
Variant:          LockBit 3.0 (Black)
Extension:        .lockbit3
Ransom Note:      README-LOCKBIT.txt
Tor Site:         lockbit[redacted].onion
Deployment:       Group Policy Object pushing ransomware.exe to all domain-joined systems
Initial Access:   VPN credential compromise (no MFA)
Dwell Time:       12 days
Data Exfiltration: Yes - 47GB uploaded to MEGA via rclone prior to encryption

Step 2: Immediate Containment

Stop ransomware propagation before assessing damage:

• Priority 1: Disconnect affected network segments from core infrastructure (pull the network cable, not shutdown)
• Priority 2: Isolate all domain controllers immediately if GPO-based deployment is suspected
• Priority 3: Disable the compromised accounts used for deployment
• Priority 4: Block lateral movement protocols (SMB TCP/445, RDP TCP/3389, WinRM TCP/5985-5986)
• Priority 5: Preserve at least one encrypted system live (do not power off) for memory forensics
• Do NOT: Shut down encrypted systems; keep them powered on to preserve encryption keys in memory

Step 3: Assess Damage and Scope

Quantify the impact to inform recovery and business decisions:

• Count the number of encrypted systems (workstations, servers, domain controllers)
• Determine which business-critical systems and data are affected
• Verify backup integrity: check that backups were not encrypted, deleted, or corrupted
• Assess whether data exfiltration occurred (check for rclone, WinSCP, MEGA, cloud storage activity)
• Determine the ransom demand amount and payment deadline
• Check OFAC sanctions lists to verify the ransomware group is not a sanctioned entity (paying is legally risky)

Impact Assessment:
Encrypted Systems:      187 of 340 endpoints (55%)
Encrypted Servers:      12 of 28 (43%) - includes 2 file servers, 1 database server
Domain Controllers:     2 of 3 encrypted
Backup Status:          Veeam repository intact (offline copy verified clean)
Data Exfiltration:      Confirmed - 47GB to MEGA (file listing under analysis)
Ransom Demand:          $2.5M in Bitcoin (72-hour deadline)
OFAC Screening:         LockBit - not currently sanctioned entity (verify with counsel)

Step 4: Recovery Decision Matrix

Evaluate recovery options in consultation with legal, executive leadership, and cyber insurance:

Step 5: Execute Recovery

Implement the chosen recovery strategy:

If restoring from backup:

1. Build a clean isolated network segment for recovery operations
2. Rebuild domain controllers first from clean media (do NOT restore DC backups older than the dwell time)
3. Reset ALL user and service account passwords before joining any system to the new domain
4. Restore servers in priority order: authentication, DNS, DHCP, then business-critical applications
5. Restore workstations via reimaging, not file-level restore
6. Restore data from verified clean backups to rebuilt file servers
7. Reconnect to production network only after validation

If using a decryptor:

1. Test the decryptor on a non-critical system first
2. Decrypt in order of business priority
3. Scan all decrypted systems for residual malware before reconnection