performing-ransomware-response

Follow a structured workflow: confirm the ransomware variant using the ransom note and file extensions, disconnect affected network segments without powering off systems, assess encrypted systems and backup integrity, then choose a recovery path such as restoring from verified clean backups.

Restore from verified clean backups is the default when available, since payment carries legal risk and no guarantee of a working decryptor. Any payment decision requires OFAC sanctions screening and legal counsel review, as paying a sanctioned group is itself a violation.

For some ransomware variants the symmetric encryption key exists only in memory, so shutting down destroys it. Pull the network cable to isolate the host while keeping at least one encrypted system live for memory forensics.

Establish the attacker's initial access date through forensics, then only trust restore points older than that dwell-time window. Scan restored data with YARA or EDR in an isolated network before reconnecting, and confirm backups are genuinely immutable or air-gapped.

Upload the ransom note and a sample encrypted file to ID Ransomware to identify the variant, then check NoMoreRansom.org for available free decryptors. EDR and SIEM logs help determine the deployment method and ransomware group.

Do not use it for general malware incidents that do not involve file encryption or extortion. Standard malware incident response procedures are more appropriate for infections without encryption or ransom demands.