skills.rest
blamejs
blamejsOFFICIAL
Explore all skills by this author →
WebsiteGitHub

ransomware-response

Screen sanctions, check decryptors, notify insurers, and test backups during ransomware incidents.

Updated May 11, 2026
Search Tags:#ransomware#incident response#sanctions screening#breach notification#cyber insurance#immutable backup#decryptor lookup
One-click install
npx skills add https://github.com/blamejs/exceptd-skills --skill ransomware-response
Or copy as Structured Prompt for Agent▼
Please help me install this Agent Skill.
Skill: ransomware-response
Source: https://github.com/blamejs/exceptd-skills/tree/main/skills/ransomware-response
Command: npx skills add https://github.com/blamejs/exceptd-skills --skill ransomware-response

SYSTEM DOCUMENTATION & REQUIREMENTS

What problem does it solve?

Standard incident response playbooks do not cover ransomware-specific decision points including OFAC and cross-jurisdiction sanctions screening, decryptor availability lookup, cyber-insurance carrier notification requirements, immutable backup viability testing, and exfil-before-encrypt breach classification, leaving organizations vulnerable to legal penalties, insurance denial, and incomplete recovery during ransomware incidents.

Core Features & Use Cases

  • Cross-Jurisdiction Sanctions Screening: Automate checks against OFAC SDN, EU Reg 2014/833, UK OFSI, AU DFAT, and JP MOF sanctions lists to block illegal ransom payments and avoid federal-law violations.
  • Decryptor Availability Lookup: Integrate No More Ransom Project and vendor-specific decryptor catalogs to identify free decryption options before considering ransom payment.
  • Cyber-Insurance Workflow Integration: Enforce 24h carrier notification and pre-approval requirements to prevent policy voiding and ensure coverage for incident response costs.
  • Immutable Backup Viability Testing: Validate that backup snapshots are truly immutable and recoverable before relying on them for restoration.
  • Parallel Breach Notification: Classify exfil-before-encrypt as a distinct breach trigger to meet overlapping regulatory clocks (NIS2 24h, GDPR 72h, HIPAA 60d, SEC 8-K 4 days, etc.) independent of the encryption event.
  • Use Case: A healthcare organization hit by ALPHV/BlackCat ransomware with PHI exfiltrated before encryption uses this skill to screen the threat actor against sanctions, confirm no decryptor is available, notify its cyber insurer within the 24h window, test immutable backup restore, and trigger HIPAA and GDPR breach notifications on the exfiltration event separately from the encryption event.

Quick Start

Use the ransomware-response skill to guide your incident response team through the full ransomware decision workflow, from encryption confirmation and sanctions screening to decryptor lookup, insurance notification, and regulatory breach reporting, for any active ransomware incident.

Frequently Asked Questions about ransomware-response

High-intent search queries and answers about installing and using this skill.

FAQPage Schema
How do I handle ransomware incident response compliance for sanctions screening and breach notification?▼

Ransomware incident response compliance requires screening threat actors against OFAC and cross-jurisdiction sanctions lists, then triggering parallel breach notification clocks under HIPAA, GDPR, NIS2, DORA, SEC 8-K, and CIRCIA for exfiltration events.

What is exfil-before-encrypt breach classification and when do regulatory notification clocks start?▼

Exfil-before-encrypt breach classification treats data exfiltration as a distinct breach trigger, starting overlapping regulatory notification clocks like NIS2 24h, GDPR 72h, HIPAA 60d, and SEC 8-K 4 days independently from the encryption event.

How do I check No More Ransom Project decryptor availability before considering a ransom payment?▼

Decryptor availability lookup integrates No More Ransom Project and vendor-specific catalogs to identify free decryption options for active ransomware families, ensuring teams exhaust recovery options before considering ransom payments.

Does cyber insurance require carrier notification during a ransomware incident?▼

Cyber insurance workflow integration enforces 24h carrier notification and pre-approval requirements during ransomware incidents, preventing policy voiding and ensuring coverage for incident response costs.

How do I validate immutable backup viability for ransomware recovery?▼

Immutable backup viability testing validates that backup snapshots are truly immutable and recoverable before relying on them for restoration, ensuring encrypted systems can be safely recovered without paying ransom.

What ransomware response steps are needed for regulated industries facing encryption and data exfiltration?▼

Regulated industries need ransomware response steps covering sanctions screening, decryptor lookup, cyber-insurance notification, immutable backup testing, and parallel breach notification to satisfy operational compliance across multiple jurisdictions.

Related Skills

Explore More Legal & Compliance Skills→
aws-samplesaws-samples
6

fsi-ransomware-respond

Direct users to available ransomware response guidance during the Respond phase.

Official
Basic
robotijnrobotijn
3

incident-responder

Coordinate NIST-aligned incident response runbooks with regulatory deadline tracking.

Community
Advanced
GoldenZeroGoldenZero
1

sanctions-screening-review

Analyze sanctions screening matches and document compliance dispositions.

Community
Advanced
blamejsblamejs

incident-response-playbook

Generate NIST, ISO, and SANS aligned incident response playbooks for AI-class incidents.

Official
Advanced