Ransomware Incident

CriticalDevOps SecurityN/A - Infrastructure Security

Malicious encryption of critical systems and data by threat actors demanding payment for decryption keys, causing operational disruption, data loss, and potential regulatory exposure.

Immediate Response

1Isolate affected systems from the network immediately to prevent spread.
2Activate the incident response team and engage legal counsel and cyber insurance.
3Preserve forensic evidence: capture memory dumps, disk images, and network logs.
4Do not pay the ransom without consulting law enforcement and incident response experts.

All playbooks

1Identify the ransomware variant and check for publicly available decryption tools.
2Restore systems from verified clean backups taken before the infection.
3Patch all exploited vulnerabilities and rotate all compromised credentials.
4Conduct a full threat hunt across the environment to identify remaining persistence.

Long-term Prevention

1Implement immutable, offline backups with regular restoration testing.
2Deploy EDR/XDR solutions with behavioral ransomware detection capabilities.
3Enforce MFA on all remote access and privileged accounts.
4Conduct regular ransomware tabletop exercises and update incident response playbooks.

Attack vectors

Phishing emails with malicious attachments or links delivering ransomware payloads
Exploitation of unpatched vulnerabilities in internet-facing systems (e.g., Log4Shell, ProxyShell)
Compromised RDP or VPN credentials enabling direct ransomware deployment
Supply chain compromise delivering ransomware through trusted software updates

Indicators of compromise

Mass file encryption with ransom notes left in affected directories
Unusual outbound network traffic to known command-and-control infrastructure
Disabled security tools, deleted backups, or modified group policies
Lateral movement indicators preceding encryption (PsExec, WMI, RDP sessions)

Tooling

No More Ransom ProjectEDR/XDR platformsVelociraptorVolatilityCISA Ransomware Guide