Ransomware Response and Recovery Triage

Ransomware is more than encrypted files

Modern ransomware incidents may involve stolen credentials, remote access tools, lateral movement, data theft, encryption, extortion emails and public leak threats. Restoring from backup may be only one part of the answer. You also need to understand how the intrusion began, whether data left the environment and whether the attacker still has access.

Immediate priorities

1. Preserve the scene
   Photograph ransom notes, record error messages and keep copies of suspicious emails, alerts and logs.
2. Contain safely
   Disconnect affected systems where appropriate, but avoid mass wiping or reinstalling before key evidence is captured.
3. Map impact
   List affected servers, endpoints, accounts, shared drives, backups, cloud systems and business processes.
4. Plan recovery
   Validate backups, identify clean restore points and prioritise essential operations.

Evidence that can answer key questions

• Endpoint alerts, VPN and remote desktop logs.
• Firewall, email, identity provider and cloud audit logs.
• Backup job history and failed login records.
• Ransom notes, attacker emails and leak site references.
• Timeline of first symptoms, discovery and actions taken.

Why specialist triage matters

A rushed restore can bring the attacker back in. A careful forensic brief helps separate recovery, containment, insurance, legal, privacy and communications work so decisions are made with better facts.

Avoid contacting attackers, paying demands or publishing details without appropriate legal, insurance and incident-response advice.

Related help