Initial Access via Vulnerable Systems
Unpatched VPN gateways and firewalls, exposed remote access such as RDP, or service providers’ maintenance access are common entry points.
Incident Response & Forensics
Ransomware Response: What to Do When Your Data Is Encrypted
Contain first, then restore.
Ransomware attack – what do you do when your data is encrypted and a ransom demand appears on the screen? Disconnect affected systems from the network without shutting them down, don’t respond to the demand, and get help. Our ransomware response supports you remotely and on-site in stopping the attack, uncovering the cause and restoring your systems cleanly.
- 24/7 emergency hotline
- Remote & on-site
- Coordination with cyber insurers
First Steps
Ransomware Attack: What to Do When Data Is Encrypted?
In a ransomware attack, criminals encrypt data and systems and demand a ransom for the key. It has become common for them to steal data first and threaten to publish it on a leak site on the dark web – experts call this double extortion. Some groups even extort victims without any encryption at all, using stolen data alone. Encryption is usually the final step: often the attackers have already been in the network undetected for days or weeks.
The first steps: unplug the network cable of affected systems, but don’t shut them down, and don’t log on to them with administrator accounts. Disconnect any backups that are still intact, don’t delete anything – not even ransom notes – and don’t contact the attackers before the approach has been agreed. Document your observations and get support early.
And the ransom? The BSI (Germany’s Federal Office for Information Security), the police and the No More Ransom initiative supported by Europol generally advise against paying. We don’t conduct ransom negotiations. We work toward getting you back up and running without paying, and we tell you openly what is realistic.
Our Approach
Our Ransomware Response: How We Help After an Attack
First, we stop the spread: affected systems and network segments are isolated, attacker access such as VPN accounts, remote maintenance tools and command-and-control connections is blocked, and intact backups are protected from further access. In parallel, we secure volatile evidence before it’s lost.
Then we determine the extent: Which systems and accounts are compromised, is Active Directory affected, and which data was exfiltrated? We also identify the ransomware family and check whether a free decryption tool exists.
Wherever possible, the return to operations only begins once the entry point and backdoors are known: prioritized by your critical business processes, from verified backups and into a cleaned-up environment. The BSI recommends that infected systems generally be treated as fully compromised and rebuilt – a virus scan alone is not enough. Module DER.2.3 “Clean-Up of Extensive Security Incidents” of the BSI’s IT-Grundschutz framework also provides guidance.
Typical Attack Chain
How Ransomware Attacks Unfold
Stolen Credentials and Phishing
Passwords from data leaks or infostealers and weaponized email attachments open the door – especially where multi-factor authentication isn’t in place.
Spread and Privilege Escalation
Using legitimate admin tools, stolen passwords and vulnerabilities in Active Directory, the attackers work their way up to domain administrator.
Sabotage of Backups and Security Software
Before encrypting, the attackers delete shadow copies and reachable backups and disable antivirus or EDR.
Data Exfiltration
Large volumes of data are moved to cloud storage or the attackers’ servers – the basis for the later threat of publication.
Encryption of Servers and Hypervisors
Rather than individual computers, the attackers prefer to encrypt file servers and virtualization hosts – bringing many systems to a halt at once.
Extortion via Leak Sites
The ransom demand comes with a deadline, often accompanied by a post on a leak site and pressure on customers or partners.
Starting Points
Three Situations, Three Priorities
Acute
The Attack Is Still Underway
The attackers are in the network, the first systems are being encrypted or security software is raising alerts. Now it’s about limiting the damage.
- Isolation of affected systems and segments
- Locking attacker accounts and remote access
- Protecting backups from encryption
After Encryption
Systems Are Encrypted
Operations are fully or partially at a standstill. Now investigation and a safe return to operations are what count.
- Scoping and forensic evidence preservation
- Assessment of backups and decryption options
- Prioritized rebuild of critical processes
Data Theft
Extortion Without Encryption
Systems are running, but the attackers are threatening to publish stolen data. Now facts about the exfiltration are what count.
- Analysis of which data was exfiltrated
- Basis for reports and notifications
- Closing the entry point
Process
Our Approach to a Ransomware Attack
As across our entire Incident Response & Forensics practice, we work along the proven phases of incident handling and coordinate every step with your crisis team. We define the scope with you individually.
-
01
First Contact & Immediate Measures
You describe the situation via the emergency hotline or the emergency form. We recommend first steps and clarify the scope of the engagement and the type of deployment.
-
02
Containment
We stop the spread, close the attackers’ access and protect intact backups.
-
03
Analysis & Scoping
We secure evidence, identify the ransomware and determine the entry point, spread and data exfiltration.
-
04
Eradication
Backdoors are removed, compromised systems rebuilt and all credentials reset – if Active Directory is compromised, this can go as far as resetting the KRBTGT password twice or rebuilding the directory.
-
05
Recovery
Prioritized return to operations from verified backups into a cleaned-up environment, with heightened attention to renewed attacker activity.
-
06
Post-Incident Review
Final report, lessons learned and an action plan against future attacks.
Final Report
The Incident Report: Facts for Executives, Authorities and Insurers
Our report records how the attack unfolded, what was affected and which measures were taken. It’s structured so that you can use it for reports, for your insurer and – if you file a criminal complaint – for the investigating authorities.
- Executive summary with cause, extent and status
- Timeline from initial access through data exfiltration to encryption
- Ransomware family and indicators of compromise (IoCs)
- Affected systems, accounts and – as far as can be determined – exfiltrated data
- Documentation of evidence preservation and recovery
- Lessons learned and prioritized measures
Encrypted? Call Us Before You Decide.
Decisions about the ransom demand, rebuilding and communication need facts. You can reach us at +49 2932 465265-0 – outside business hours via our 24/7 emergency hotline.
FAQ
Frequently Asked Questions About Ransomware Attacks
Didn’t find your question? Call us at +49 2932 465265-0 or email info@rootsektor.de.
Should we pay the ransom?
We advise against it – as do the BSI and the police. Paying gives you no assurance of a working key or that stolen data will be deleted; in addition, every payment funds further attacks and can make you a repeat target. A payment can also raise legal issues, for example if the attackers are subject to sanctions. The decision lies with your senior management – in consultation with legal counsel and law enforcement. We don’t conduct ransom negotiations, but we provide the facts on backups, extent and alternatives.
Can we get our data back without paying the ransom?
If intact backups exist – such as offline or immutable backups – usually yes. For some ransomware families, free decryption tools are also available, for example via No More Ransom; we check whether one fits your case. However, if backups were encrypted as well or are incomplete, some data can’t be recovered – no reputable provider can rule that out.
Was data stolen as well?
You should assume so until proven otherwise – the BSI points out that attackers now routinely copy data as well. Analyzing firewall, proxy and system logs can show whether any data was exfiltrated – and if so, which. This is crucial for reports under Art. 33 and 34 GDPR and for informing customers. Our automated Dark Web Monitoring helps you keep track of whether company data later turns up on leak sites.
Do we have to report a ransomware attack?
Often, yes. If personal data is affected – even if it’s “only” encrypted and therefore unavailable – a report to the data protection supervisory authority under Art. 33 GDPR may be required: without undue delay and, where feasible, within 72 hours of becoming aware of the breach. Entities covered by NIS2 – including operators of critical facilities – report significant incidents to the joint reporting office of the BSI and the BBK (Federal Office of Civil Protection and Disaster Assistance), starting with an early warning within 24 hours; financial entities report major ICT-related incidents to their supervisory authority under DORA. We also recommend filing a criminal complaint, for example via the Central Contact Point for Cybercrime (ZAC) in your federal state.
Can we simply restore the systems from backup?
Not without groundwork. Backups may contain malware or backdoors planted before the encryption, and if the entry point hasn’t been closed, a renewed attack looms. That’s why we check backups for traces of the attackers, clean up the environment and reset credentials before anything is restored – ideally using copies of the backups so that the originals remain unchanged.
How long will it take until we can work again?
That depends on the extent, the condition of the backups and how well prepared you are. Based on experience, the BSI puts this at two to four weeks for a full compromise, during which large parts of operations may be restricted. Emergency operations for core processes are often possible sooner – and that’s what we align the return to operations with.
How do we protect ourselves against ransomware in the future?
Among the most effective levers are timely updates for perimeter systems, multi-factor authentication for all remote access, a segmented infrastructure, separate administrator accounts and regularly tested offline backups. A vulnerability assessment and a network penetration test show whether entry points are open. With Forensic Readiness, you make sure the necessary logs are available when it counts.
Related pages
Report a Ransomware Incident
Briefly describe the situation and leave a callback number. If it’s urgent, call us as well: +49 2932 465265-0 – outside business hours, this number reaches our 24/7 emergency hotline.