How to Respond to a Ransomware Attack

Step by step

1. 1

   Activate your incident response process

   Declare an incident and stand up your response team before you touch anything. NIST SP 800-61 frames incident handling as a lifecycle — preparation, detection and analysis, containment/eradication/recovery, and post-incident activity — and ransomware runs through all of it. Pull out your IR plan, open a dedicated communications channel that does not depend on the systems you suspect are compromised, assign an incident commander, and start a contemporaneous timeline. If you have an IR retainer or cyber insurer, this is the moment they expect to hear from you, not days later.

2. 2

   Contain without destroying forensics

   Isolate affected hosts from the network to stop lateral movement and further encryption — pull the network cable, disable the switch port, or quarantine via EDR. CISA #StopRansomware guidance is explicit that you should isolate systems rather than power them off where feasible, because a hard shutdown can wipe volatile memory and artifacts that forensics and decryption efforts may need. Only power down if you cannot otherwise disconnect a system and encryption is actively spreading. Preserve, do not reimage, affected machines until forensics has what it needs.

3. 3

   Preserve evidence and logs immediately

   Logs and artifacts are overwritten and rotated out fast, so capture them early: memory images where practical, disk images of representative affected and patient-zero systems, EDR telemetry, firewall and VPN logs, authentication and domain controller logs, and copies of the ransom note and any dropped tooling. Record who did what and when. This evidence drives scoping, supports any law-enforcement referral or insurance claim, and may be the only path to attribution or a decryptor.

4. 4

   Scope the intrusion — do not assume encryption is the whole story

   Determine how the attacker got in, how long they have had access (dwell time), which accounts and systems are compromised, and whether data was exfiltrated before encryption. Modern ransomware is frequently double-extortion: the operators steal data and threaten to publish it, so "we have clean backups" does not by itself resolve the incident. Identify the initial access vector, persistence mechanisms and any domain-admin compromise before you declare systems safe, or you will be reinfected.

5. 5

   Notify legal, leadership, insurer and law enforcement

   Engage legal counsel early — ideally directing the investigation so work can be handled under privilege where appropriate — and brief leadership with a factual, evolving picture. Notify your cyber insurer promptly; policies often require it and may dictate approved forensics and negotiation vendors. Report to law enforcement: in the US, CISA and the FBI (via a local field office or IC3.gov) ask to be notified of ransomware incidents, and reporting can unlock assistance and threat intelligence. Track any statutory or contractual breach-notification deadlines that a data-theft component may trigger.

6. 6

   Engage IR and forensics specialists

   Unless you have deep in-house incident-response capability, bring in a specialist digital-forensics and incident-response (DFIR) firm — triggered through your insurer or retainer where one exists. They will confirm the ransomware family, hunt for persistence and additional footholds, validate scope, and advise on eradication so recovery does not simply restore the attacker along with your data. Experienced responders also know the current behavior of specific ransomware operators, which shapes both recovery and any negotiation.

7. 7

   Assess backups and recovery feasibility

   Locate your backups, confirm they are intact and were not reachable or deleted by the attacker, and test-restore in an isolated environment before trusting them — attackers routinely target backup infrastructure first. Before attempting decryption by any route, check the No More Ransom project (nomoreransom.org), a joint effort of Europol, law enforcement and security vendors that offers free decryptors for many ransomware families. Rebuild from known-good images where restore is not safe, and reset credentials broadly, since stolen secrets are assumed compromised.

8. 8

   Understand the legal risk before considering payment

   Payment is a business and legal decision, not a technical one, and it carries real risk: it may be sanctions-prohibited. The US Treasury’s Office of Foreign Assets Control (OFAC) has issued advisories warning that facilitating a ransom payment to a sanctioned person or jurisdiction can itself violate US sanctions law, and that liability can apply on a strict-liability basis regardless of whether the payer knew. Paying also does not guarantee a working decryptor or that stolen data will be deleted. If payment is even considered, involve counsel, your insurer and law enforcement, and have specialists perform sanctions due diligence first — do not assume any specific actor is or is not sanctioned.

9. 9

   Manage communications and recover deliberately

   Coordinate internal and external messaging through legal and leadership: tell employees what they need to do, and prepare regulator, customer and partner notifications on the timelines the facts require. Recover in a prioritized, staged way — restore the most critical services first, into a hardened environment, with monitoring in place to catch reinfection. When the dust settles, run a formal post-incident review: what the root cause was, what detection missed, and which controls and playbook steps to fix so the next attempt fails earlier.

Related