The most damaging mistake in a ransomware incident is not the initial breach. It is the reaction. When the ransom note appears, the instinct is to pull every plug, reboot the servers, and start restoring backups immediately. That instinct destroys the very forensic evidence you need to understand how the attackers got in, and it often reinfects clean systems because the intruder still has a foothold you never found. Ransomware is rarely a “smash and grab.” By the time files encrypt, an operator has usually been inside your network for days or weeks, moving laterally, stealing credentials, and quietly copying data for double extortion. Responding well means treating the encryption as the loud end of a long, quiet campaign.
This guide walks through how a competent team actually handles a ransomware event, from the first alert to the lessons that stop it happening again.
Recognizing It Early, Before the Note Appears
The encryption itself is the last act. The signals that matter come earlier, and catching them is the difference between losing one server and losing the domain. Watch for the tell-tale precursors: a spike in failed logins followed by a successful one, unexpected use of administrative tools like PsExec or PowerShell remoting, new scheduled tasks, and the sudden appearance of tools such as Cobalt Strike, Mimikatz, or Rclone (a common data-theft utility).
If you have endpoint logs or EDR telemetry, a few quick queries surface trouble. A blunt but effective one is looking for mass file modification, which is what encryption looks like on disk:
# On Linux, find files modified in the last 15 minutes across a share
find /srv/fileshare -type f -mmin -15 -printf '%TT %p\n' | sort | tail -50
# Spot suspicious new extensions appearing en masse
find /srv -type f -newermt '-1 hour' \( -name '*.locked' -o -name '*.encrypted' \) | wc -lOn Windows, a sudden burst of file renames and the deletion of Volume Shadow Copies is a screaming red flag, because attackers almost always destroy shadow copies to prevent easy recovery:
# Attackers run this to wipe recovery points — seeing it in logs is a critical alert
vssadmin delete shadows /all /quiet
# Defensively, hunt for that command in event logs
Get-WinEvent -LogName Security | Where-Object { $_.Message -match 'vssadmin' }The goal of detection is not just to confirm you have ransomware. It is to establish scope: which machines, which accounts, and how far it has spread.
Containment Without Burning the Evidence
Once you confirm an active infection, the priority is to stop the spread while preserving what happened. This is a balancing act. Speed limits the damage, but recklessness costs you the forensic trail and can trip attacker “dead-man switches.”
The right move is isolation, not shutdown. Disconnect affected hosts from the network — pull the cable, disable the switch port, or quarantine them through your EDR — but leave them powered on where possible. A running machine holds volatile evidence in memory: encryption keys, active network connections, and process trees that vanish the instant you power off.
Practical containment steps, roughly in order:
- Segment the network. Cut connectivity between subnets to stop lateral movement. If the blast radius is unclear, isolate aggressively.
- Disable compromised accounts and force a reset of privileged credentials, especially domain admin accounts. Assume every credential used on an infected host is burned.
- Block command-and-control. Identify the outbound IPs and domains the malware is calling and null-route or firewall them.
- Protect the backups first. Attackers target backup infrastructure deliberately. Take backup servers offline or make them immutable before doing anything else, so your recovery path stays intact.
Eradication comes after containment. This means finding and removing every persistence mechanism — malicious scheduled tasks, new services, rogue accounts, web shells — not just the ransomware binary. If you rebuild a server from a “clean” image but leave the attacker’s backdoor in Active Directory, they simply walk back in. This is why rebuilding from known-good gold images, rather than cleaning in place, is the safer default for anything the attacker touched.
Deciding About the Ransom, and Who to Tell
At some point leadership will ask the uncomfortable question: do we pay? There is no clean answer, but a few facts should anchor the discussion. Paying does not guarantee recovery — decryptors are often buggy and slow, and some never arrive. Paying also marks you as a willing payer, inviting repeat attacks. And in some jurisdictions, paying a group under sanctions can itself be illegal, which is why this decision belongs to executives and legal counsel, never to the technical team acting alone.
Before assuming payment is the only path, check whether a free decryptor exists. The No More Ransom project, run by Europol and industry partners, hosts free tools for many strains:
# Identify the strain first — upload the ransom note and a sample
# encrypted file to https://www.nomoreransom.org/crypto-sheriff.php
# If the family is known and flawed, a free decryptor may already exist.Communication is a workstream of its own, and it runs in parallel with the technical response. The instinct to stay quiet is understandable and usually wrong. Key audiences to plan for:
- Internal stakeholders and staff, who need clear, calm instructions (often “do not turn your computer on”) delivered through a channel the attacker cannot read — assume email and chat may be compromised, and use out-of-band methods like phone trees.
- Regulators. Depending on your data and location, you may face hard legal deadlines. GDPR requires notification of a qualifying breach within 72 hours; regimes like HIPAA and various US state and SEC rules impose their own timelines. Missing these carries penalties independent of the attack itself.
- Law enforcement. Reporting to bodies such as the FBI, CISA, or your national CERT can unlock intelligence, sometimes decryption keys seized from the group, and is increasingly expected.
- Customers and partners, especially if their data was exfiltrated. Modern ransomware is a data-breach event as much as an availability event, because operators steal data before encrypting and threaten to leak it.
Keep a written timeline from the very first alert. Who saw what, when, and what action they took. This record is invaluable for regulators, insurers, and your own after-action review.
Recovery and Turning Pain Into Prevention
Recovery is deliberate, not a race. Restore systems in priority order — domain controllers and identity first, then the business-critical services that everything else depends on. Crucially, only restore into a network you have confirmed is clean, and validate that your backups themselves are not carrying the attacker’s persistence forward. Reset every credential across the domain before bringing users back, because you must assume the entire directory was compromised.
Once the fire is out, the real value comes from the post-incident review. Run a blameless retrospective that answers three questions: How did they get in? Why did they move so far undetected? What would have stopped or slowed them? The answers almost always point to a small set of fixable gaps:
- Multi-factor authentication missing on VPN, RDP, or email — the single most common entry point.
- Flat networks with no segmentation, letting one compromised laptop reach the whole estate.
- Backups that were online, mutable, and therefore encrypted along with everything else. The gold standard remains 3-2-1: three copies, two media types, one offline or immutable.
- Slow or absent detection, meaning no EDR, unmonitored logs, or alerts nobody was watching.
Then test the fixes. A tabletop exercise that walks your team through a simulated attack will expose the gaps in your plan far more cheaply than a real incident will.
The Takeaway
Ransomware response is less about heroics at the keyboard and more about discipline under pressure. The teams that come through well are the ones that resist the urge to react blindly: they isolate rather than shut down, they preserve evidence, they hunt for the attacker’s foothold before restoring, and they communicate honestly and on schedule. The encryption is the symptom of a deeper compromise, and treating only the symptom guarantees a sequel. Build the plan, write down the phone numbers and legal deadlines, keep your backups offline, and rehearse the whole thing before you ever need it. When the note finally appears, a rehearsed response turns a potential extinction event into a bad week.