| name | performing-ransomware-response |
| description | Executes a structured ransomware incident response from initial detection through containment, forensic analysis, decryption assessment, recovery, and post-incident hardening. Addresses ransom negotiation considerations, backup integrity verification, and regulatory notification requirements. Activates for requests involving ransomware response, ransomware recovery, crypto-ransomware, data encryption attack, ransom payment decision, or ransomware containment.
|
| domain | cybersecurity |
| subdomain | incident-response |
| tags | ["ransomware","encryption-recovery","backup-restoration","ransom-negotiation","CISA-guidance"] |
| mitre_attack | ["T1486","T1490","T1489","T1021","T1570"] |
| version | 1.0.0 |
| author | mahipal |
| license | Apache-2.0 |
| nist_csf | ["RS.MA-01","RS.MA-02","RS.AN-03","RC.RP-01"] |
Performing Ransomware Response
When to Use
- Ransomware has been detected executing or file encryption is actively occurring
- Users report inability to open files with unfamiliar extensions appended
- A ransom note is discovered on one or more systems
- EDR detects mass file modification patterns consistent with encryption behavior
- Threat intelligence warns of an imminent ransomware campaign targeting the organization
Do not use for general malware incidents that do not involve file encryption or extortion; use malware incident response procedures instead.
Prerequisites
- Ransomware-specific incident response playbook reviewed and approved by executive leadership
- Tested and verified offline backup strategy with air-gapped or immutable copies
- Incident retainer with a specialized ransomware response firm (e.g., Mandiant, CrowdStrike Services, Kroll)
- Legal counsel pre-engaged for OFAC sanctions screening and regulatory notification
- Cyber insurance carrier contact information and policy coverage details
- Bitcoin/cryptocurrency analysis capability or third-party engagement for payment tracing
Workflow
Step 1: Detect and Confirm Ransomware
Validate that the incident is ransomware and determine the variant:
- Identify the ransomware by analyzing the ransom note filename, extension appended to encrypted files, and note content
- Upload the ransom note and a sample encrypted file to ID Ransomware (id-ransomware.malwarehunterteam.com)
- Check NoMoreRansom.org for available free decryptors
- Determine the ransomware deployment method from EDR/SIEM logs
- Identify the ransomware group (e.g., LockBit, BlackCat/ALPHV, Royal, Akira, Play)
Ransomware Identification:
━━━━━━━━━━━━━━━━━━━━━━━━━
Variant: LockBit 3.0 (Black)
Extension: .lockbit3
Ransom Note: README-LOCKBIT.txt
Tor Site: lockbit[redacted].onion
Deployment: Group Policy Object pushing ransomware.exe to all domain-joined systems
Initial Access: VPN credential compromise (no MFA)
Dwell Time: 12 days
Data Exfiltration: Yes - 47GB uploaded to MEGA via rclone prior to encryption
Step 2: Immediate Containment
Stop ransomware propagation before assessing damage:
- Priority 1: Disconnect affected network segments from core infrastructure (pull the network cable, not shutdown)
- Priority 2: Isolate all domain controllers immediately if GPO-based deployment is suspected
- Priority 3: Disable the compromised accounts used for deployment
