performing-ransomware-response

name	performing-ransomware-response
description	Executes a structured ransomware incident response from detection through containment, forensic analysis, decryption assessment, recovery, and post-incident hardening, covering ransom negotiation, backup integrity verification, and regulatory notification. Use when actively responding to a ransomware outbreak or crypto-ransomware infection, or deciding on ransom payment and containment steps.
domain	cybersecurity
subdomain	incident-response
tags	["ransomware","encryption-recovery","backup-restoration","ransom-negotiation","CISA-guidance"]
mitre_attack	["T1486","T1490","T1070","T1078","T1489"]
mitre_f3	{"version":"1.1","tactics":["monetization","stealth","initial-access"],"techniques":[{"id":"F1018","name":"Convert to Cryptocurrency","tactic":"monetization","source":"f3"},{"id":"F1017","name":"Conversion to Physical Monetary Instruments","tactic":"monetization","source":"f3"},{"id":"F1025.003","name":"Electronic Funds Transfer: Wire Transfer","tactic":"monetization","source":"f3"},{"id":"T1070","name":"Indicator Removal","tactic":"stealth","source":"attack"},{"id":"F1006","name":"Account Takeover","tactic":"initial-access","source":"f3"}]}
version	1.0.0
author	mahipal
license	Apache-2.0
nist_csf	["RS.MA-01","RS.MA-02","RS.AN-03","RC.RP-01"]

Performing Ransomware Response

When to Use

• Ransomware has been detected executing or file encryption is actively occurring
• Users report inability to open files with unfamiliar extensions appended
• A ransom note is discovered on one or more systems
• EDR detects mass file modification patterns consistent with encryption behavior
• Threat intelligence warns of an imminent ransomware campaign targeting the organization

Do not use for general malware incidents that do not involve file encryption or extortion; use malware incident response procedures instead.

Prerequisites

• Ransomware-specific incident response playbook reviewed and approved by executive leadership
• Tested and verified offline backup strategy with air-gapped or immutable copies
• Incident retainer with a specialized ransomware response firm (e.g., Mandiant, CrowdStrike Services, Kroll)
• Legal counsel pre-engaged for OFAC sanctions screening and regulatory notification
• Cyber insurance carrier contact information and policy coverage details
• Bitcoin/cryptocurrency analysis capability or third-party engagement for payment tracing

Workflow

Step 1: Detect and Confirm Ransomware

Validate that the incident is ransomware and determine the variant:

• Identify the ransomware by analyzing the ransom note filename, extension appended to encrypted files, and note content
• Upload the ransom note and a sample encrypted file to ID Ransomware (id-ransomware.malwarehunterteam.com)
• Check NoMoreRansom.org for available free decryptors
• Determine the ransomware deployment method from EDR/SIEM logs
• Identify the ransomware group (e.g., LockBit, BlackCat/ALPHV, Royal, Akira, Play)

Ransomware Identification:
━━━━━━━━━━━━━━━━━━━━━━━━━
Variant:          LockBit 3.0 (Black)
Extension:        .lockbit3
Ransom Note:      README-LOCKBIT.txt
Tor Site:         lockbit[redacted].onion
Deployment:       Group Policy Object pushing ransomware.exe to all domain-joined systems
Initial Access:   VPN credential compromise (no MFA)
Dwell Time:       12 days
Data Exfiltration: Yes - 47GB uploaded to MEGA via rclone prior to encryption

Step 2: Immediate Containment

Stop ransomware propagation before assessing damage:

• Priority 1: Disconnect affected network segments from core infrastructure (pull the network cable, not shutdown)
• Priority 2: Isolate all domain controllers immediately if GPO-based deployment is suspected
• Priority 3: Disable the compromised accounts used for deployment