The first 60 minutes after a ransomware attack

A-Lab briefing · 6 minute read · For owners, IT managers and first responders

It is usually discovered early in the morning. Files will not open, a note is sitting in every folder, servers are unreachable and the phone starts ringing. The instinct is to fix things fast. In a ransomware incident, "fast" often destroys the evidence and the partially intact data that make recovery possible. This checklist is what we ask every client to do before anything else.

Minute 0 to 10: contain without destroying

1. Disconnect affected systems from the network. Unplug the cable or disable the Wi-Fi and, if you can, isolate the network segment at the switch or firewall. This stops the encryptor from reaching more systems.
2. Do not power servers off unless you cannot isolate them. Running processes and memory can contain encryption keys, the running malware and logs that will be lost forever on shutdown. This is also the guidance of CISA and every major incident-response body.
3. Do not reboot "to see if it helps". Some encryptors run their final passes on reboot. Others are only recoverable while they are still resident.
4. Use out-of-band communication. Coordinate by phone or personal mobile, not company email or chat, which the attacker may be reading.

Minute 10 to 30: preserve

5. Keep the ransom note. Copy it, photograph it, do not delete it. It identifies the family and often the exact build.
6. Keep the encrypted files exactly as they are. Do not rename them, do not remove the new extension, do not "clean up".
7. Do not format, reinstall or restore over affected disks. The encrypted originals and the deleted-but-recoverable data live on those disks. Restoring on top of them overwrites both.
8. Do not delete encrypted backups. Veeam files, VHDX files and SQL dumps that appear to be encrypted are frequently repairable. See when the backups are encrypted too.
9. Preserve logs. Firewall, VPN, domain controller and endpoint protection logs are needed to establish how the attacker got in and to satisfy regulators and insurers.

Minute 30 to 60: decide and engage

10. Do not contact the attackers. Engaging starts a clock, signals that you are considering payment and gives them information. A recovery assessment tells you whether you ever need to consider it. See why contacting the attackers is the weakest option.
11. Inform leadership, legal counsel and your cyber insurer. Many policies require notification within a fixed period and may specify approved responders.
12. Send the laboratory what it needs. The ransom note, two or three encrypted files of different types (a document, a large file such as a database or backup fragment, an image), the file extension and a short description of the environment: number of machines, hypervisors, backup product, when it happened.
13. Note UAE reporting obligations. Depending on sector and licensing, incidents may need to be reported to the UAE Cybersecurity Council, the Dubai Electronic Security Centre, the Central Bank, or the relevant free-zone authority.

What happens next

Within hours of receiving the samples, A-Lab identifies the ransomware family and version, tests recovery against the samples and reports what is recoverable, how long it will take and what it will cost. There is no obligation. If the data cannot be recovered, there is no fee.