Category: blog
Ransomware is an active security incident.
Files may be encrypted.
Accounts may be compromised.
Backups may be targeted.
The first 24 hours affect containment, evidence, recovery time, and notification requirements.
This guide provides an operational sequence for small businesses. It is not legal advice. Reporting and notification requirements depend on industry, location, contracts, cyber insurance, and the type of data involved.
First 15 minutes
Declare the incident
Assign one incident lead.
Record:
- Time of discovery
- Person reporting the incident
- Systems showing symptoms
- Ransom note details
- File extensions or naming changes
- Security alerts
- Known business impact
- Actions already taken
Maintain one incident timeline.
Use an out-of-band communication method if email, Microsoft 365, Google Workspace, or internal chat may be compromised.
Phone calls and known-clean devices should be used for response coordination.
Isolate affected systems
Stop the spread.
Affected workstations should be disconnected from Ethernet and Wi-Fi.
If multiple systems or network segments are affected, the relevant switches or network segments may need to be taken offline.
Cloud resources should be isolated through provider-supported controls.
Do not allow employees to continue working from affected devices.
Do not connect removable media.
Do not move encrypted files to other systems.
Do not shut down a device unless continued operation creates a greater risk of spread and network isolation is not possible. Memory and other volatile evidence may be lost during shutdown.
15 to 60 minutes
Activate the response team
Contact:
- Managed service provider
- Incident response provider
- Cyber insurance breach-response number
- Legal counsel
- Relevant security vendors
- Critical technology providers
Check the cyber insurance policy before authorizing forensic work, restoration, or ransom-related activity. Some policies require approved vendors and advance consent.
X-Tek can coordinate managed IT support, infrastructure review, backup assessment, and recovery activities through a controlled response process. Business IT support includes managed support plans, server maintenance, endpoint support, cloud services, and network maintenance. Details are available through the X-Tek services page.
Keep one incident lead responsible for decisions.
Multiple vendors should not make uncoordinated changes to the environment.
Preserve evidence
Evidence may be required for:
- Root-cause analysis
- Insurance claims
- Legal review
- Regulatory reporting
- Law enforcement
- Recovery decisions
- Future security controls
Preserve:
- Ransom notes
- Encrypted file samples
- Attacker emails or messages
- Wallet addresses
- Suspicious files
- Endpoint detection alerts
- Authentication logs
- VPN logs
- Firewall logs
- Cloud audit logs
- Backup logs
- Relevant system images
- Memory captures where feasible
- Security tool alerts
- Administrator activity
Record the hostname, user, IP address, time zone, timestamp, and collection method for each item.
Store evidence in an access-controlled location.
Do not delete ransom notes.
Do not wipe systems before evidence collection unless immediate containment requires it.
Do not run random decryptor tools.
One to four hours
Establish the initial scope
Determine:
- Earliest known compromise
- First affected user or system
- Current affected systems
- Network segments involved
- Cloud resources involved
- Privileged accounts involved
- Backup systems accessed
- Security tools disabled
- Evidence of lateral movement
- Evidence of data exfiltration
- Systems still operating normally
- Critical business functions affected
Ransomware may be the final stage of a longer compromise.
The attacker may have entered through:
- Stolen credentials
- Phishing
- Remote desktop services
- VPN access
- Unpatched software
- Exposed management tools
- Compromised cloud accounts
- Third-party access
Encryption does not confirm that the attacker is gone.
Secure accounts and access
With guidance from the response team:
- Disable confirmed compromised accounts
- Revoke active sessions
- Revoke exposed tokens
- Rotate privileged credentials
- Rotate VPN credentials
- Rotate email administrator credentials
- Rotate backup credentials
- Rotate cloud credentials
- Replace exposed API keys
- Review new administrator accounts
- Review unexpected privilege changes
- Review suspicious remote access
- Close the exploited access path
Password resets should be performed in a controlled sequence.
Changing passwords alone does not remove persistence.
Affected systems may need to be rebuilt.
Protect the backup environment
Backups are a primary recovery resource.
They are also a common ransomware target.
Immediately review:
- Backup console access
- Backup administrator accounts
- Backup job status
- Backup deletion activity
- Backup encryption status
- Repository access logs
- Snapshot integrity
- Offline copies
- Immutable copies
- Retention points
- Last known clean backup
Disconnect or restrict backup repositories where appropriate.
Do not connect backup media to infected systems.
Do not restore production systems directly from an untested backup.
Backup status reports are not proof of recoverability. A backup must be restored and validated in an isolated environment.
Four to 12 hours
Build a recovery priority list
Restoration should follow business dependencies.
Prioritize systems based on:
- Safety and essential operations
- Revenue generation
- Customer services
- Legal and regulatory needs
- Identity and authentication
- Network and DNS dependencies
- Core applications
- File and data services
- User endpoints
- Noncritical systems
Identity systems may need to be restored before email, file services, and applications.
Network services may need to be restored before servers.
Security monitoring should be active before systems return to production.
Recovery time objectives should guide the sequence. They should not override evidence preservation and containment requirements.
Decide whether restoration can begin
Restoration should not begin simply because the business is offline.
Before restoring, the response team should determine:
- Whether attacker access is contained
- Whether compromised accounts are controlled
- Whether the initial access path is closed
- Whether persistence has been removed
- Whether backups are clean
- Whether the recovery network is isolated
- Whether affected systems must be rebuilt
- Whether logs and evidence are preserved
- Whether monitoring is available
- Whether legal and insurance requirements are addressed
Some systems may be restored from clean backups.
Others may require reimaging or rebuilding.
High-value systems may require forensic review before restoration.
Plan temporary workarounds
Business operations may continue in a reduced state.
Approved workarounds may include:
- Manual order processing
- Paper procedures
- Alternate payment processes
- Clean replacement devices
- Alternate phone systems
- Separate communication channels
- Temporary file-sharing controls
- Offline customer service procedures
Workarounds should be documented.
Employees should receive direct instructions:
- Do not reconnect affected devices
- Do not investigate independently
- Do not delete files or messages
- Do not contact the attacker
- Do not restore systems
- Report suspicious activity to the incident lead
Communication
Communication should be controlled and accurate.
Internal updates should identify:
- What is known
- What is unknown
- What is contained
- Which systems are unavailable
- What employees must do
- What workarounds are approved
- When the next update will be issued
A two- to four-hour update cycle may be appropriate during the initial response.
External communications should be coordinated by the designated business, legal, or communications lead.
Potential stakeholders include:
- Owners and executives
- Employees
- Customers
- Vendors
- Business partners
- Cyber insurer
- Legal counsel
- Law enforcement
- Regulators
- Payment processors
Do not speculate about the attacker, data exposure, or restoration time.
Do not promise that no data was accessed unless the investigation supports that conclusion.
Possible data exfiltration should be assessed separately from file encryption.
Reporting may be made to the FBI, IC3, CISA, local law enforcement, or other relevant authorities. The CISA ransomware response checklist provides reporting and containment guidance.
The FTC data breach response guide provides additional guidance for breach assessment and notifications.
12 to 24 hours
Restore through a clean recovery environment
Use an isolated staging network.
Validate the backup before production restoration.
A controlled sequence may include:
- Build or verify the recovery network
- Restore identity and core network dependencies
- Restore security tooling
- Restore a noncritical system
- Scan restored systems
- Validate data integrity
- Test application function
- Restore critical services
- Reconnect clean systems
- Increase monitoring
- Review authentication and network activity
Reconnecting a restored system to a compromised environment can restart the incident.
Restored systems should be patched.
Credentials should be reset.
Trust relationships should be reviewed.
Administrative access should be restricted.
Monitoring should remain elevated after restoration.
Create the 24-hour status record
By the end of the first day, document:
- Incident start time
- Discovery time
- Affected systems
- Current containment status
- Suspected entry point
- Suspected ransomware family
- Privileged accounts involved
- Backup status
- Evidence preserved
- Possible data exposure
- Business functions affected
- Systems restored
- Systems awaiting restoration
- Reporting completed
- Notifications under review
- Ransom decision status
- Recovery priorities
- Estimated assumptions
- Next 24-hour actions
Ransom payment does not guarantee decryption, removal of attacker access, or prevention of data publication. Payment decisions require owners, legal counsel, the cyber insurer, and appropriate law enforcement consultation. Sanctions requirements may also apply.
NIST recommends clean backups, system rebuilding where necessary, credential changes, vulnerability remediation, strengthened trust boundaries, and increased monitoring. See the NIST Guide for Cybersecurity Event Recovery.
X-Tek managed recovery
Ransomware recovery requires coordination between incident response, infrastructure, backups, identity, communications, and business operations.
X-Tek can support:
- Initial triage
- Endpoint and server isolation
- Network review
- Backup integrity assessment
- Cloud account review
- Credential recovery
- Clean system deployment
- Server restoration
- Network restoration
- Monitoring escalation
- Managed IT support
- Recovery planning
- Post-incident remediation
Recovery should be treated as a controlled process.
Not an isolated restore task.
Not a password reset.
Not a return to normal operations before the environment is trusted.
Review X-Tek’s business IT support and infrastructure services or submit a Business Solutions Information Request.
Contact Information
Business Solutions Information Request:
https://xtekit.com/business-solutions-information-request/
815-516-8075