Name: Performing Ransomware Response
Author: mukul975

When to Use

Ransomware has been detected executing or file encryption is actively occurring
Users report inability to open files with unfamiliar extensions appended
A ransom note is discovered on one or more systems
EDR detects mass file modification patterns consistent with encryption behavior
Threat intelligence warns of an imminent ransomware campaign targeting the organization

Do not use for general malware incidents that do not involve file encryption or extortion; use malware incident response procedures instead.

Prerequisites

Ransomware-specific incident response playbook reviewed and approved by executive leadership
Tested and verified offline backup strategy with air-gapped or immutable copies
Incident retainer with a specialized ransomware response firm (e.g., Mandiant, CrowdStrike Services, Kroll)
Legal counsel pre-engaged for OFAC sanctions screening and regulatory notification
Cyber insurance carrier contact information and policy coverage details
Bitcoin/cryptocurrency analysis capability or third-party engagement for payment tracing

Option	Pros	Cons	Recommended When
Restore from backup	No payment, no legal risk	Recovery time may be days	Clean backups available
Free decryptor	No payment, fast	Rare availability	Variant has published decryptor
Negotiate and pay	Potentially faster	No guarantee, legal risk, funds threat actors	No backups, business survival at stake
Rebuild from scratch	Clean environment	Longest timeline, data loss	Backups compromised, willing to accept data loss

Term	Definition
Double Extortion	Ransomware tactic combining file encryption with data exfiltration and threat to publish stolen data
Immutable Backup	Backup storage that cannot be modified or deleted for a defined retention period, protecting against ransomware targeting backups
OFAC Sanctions	U.S. Office of Foreign Assets Control restrictions that may prohibit ransom payments to sanctioned entities or jurisdictions
Dwell Time	Days the attacker was present before deploying ransomware; critical for determining which backups are clean
Ransomware-as-a-Service (RaaS)	Criminal business model where ransomware developers lease their malware to affiliates who conduct attacks
Rclone	Legitimate cloud sync tool commonly abused by ransomware operators for data exfiltration before encryption
3-2-1-1-0 Backup Rule	Backup strategy requiring 3 copies, 2 media types, 1 offsite, 1 immutable/air-gapped, and 0 errors in recovery testing