Reacting effectively to a ransomware attack is vital due to the rising prevalence of such attacks, which have seen a significant 93% increase in the past six months. Compounding the threat, attackers employ the “Triple Extortion” technique, involving data theft before launching the attack and leveraging the threat of public data disclosure unless a ransom is paid. Preventing ransomware attacks can be challenging since attackers often employ phishing techniques to target unsuspecting employees. When an organization discovers they have been infected, it is crucial to take immediate action. Here are key steps to follow for recovering from a ransomware attack:

Step 1: Isolate the Affected Systems

 

In most cases, ransomware programs scan networks to exploit vulnerabilities and spread them laterally. Therefore, it is critical to promptly isolate the affected systems. By isolating them, you can prevent further propagation of the ransomware within your network.

Step 2: Report the Attack

 

After isolating the affected systems, it is important to report the ransomware attack to the appropriate authorities. Reporting the incident can assist in identifying the perpetrators and potentially obtaining a decryption key. It also helps leaders understand the scope of the attack and issue warnings to potential targets. In Canada, you can report the incident to Cyber Security Center. If you are uncertain about where or how to report a ransomware attack, contact your local police for guidance on the proper channels to follow.

Step 3: Shut down “Patient Zero”

 

“Patient Zero” refers to the source of the ransomware infection. To identify the source, compile a list of encrypted files and determine the users who had access to them before and during the attack. If one user is found to have accessed a significant number of open files, it is likely they are the source of the infection. In such cases, it is advisable to disable their account immediately. This action helps mitigate the risk of further infection and prevents the ransomware from spreading within the network.

Step 4: Secure Your Backups

 

During a ransomware attack, organizations often rely on backups to restore their systems and avoid paying the ransom. However, attackers are aware of this strategy and may attempt to locate and compromise or delete the backups. To safeguard your backups:

1. Keep offline copies: Maintain offline copies of your backups, disconnected from the network, to prevent them from being accessed or affected by the ransomware attack.
2. Implement password protection: Ensure that your backups are password protected, using strong and unique passwords, to add an extra layer of security.

By securing your backups offline and applying for password protection, you can enhance their resilience of ransomware protection and maintain the ability to restore your systems and data without relying on the attackers’ demands.

Step 5: Disable All Maintenance Tasks

 

After a ransomware attack, it is crucial to conduct a forensic investigation to determine the cause and extent of the incident. To facilitate the investigation, it is recommended to disable all maintenance tasks that could potentially interfere with the process. This includes tasks such as deleting unnecessary or temporary files, installing updates, or any other automated processes that could modify or remove critical evidence. By temporarily disabling these tasks, you can ensure that the forensic investigation proceeds smoothly without any unintended alterations or disruptions.

Step 6: Backup the Infected Systems

 

When dealing with a ransomware attack, the instinctive response may be to reformat the infected drives and restore a backup. However, this approach eliminates all evidence of the incident, making it difficult to determine the cause. Before taking such measures, consider the following steps:

1. Explore free decryption tools: Look for reputable, free ransomware decryption tools that can unlock your files without paying the ransom. Be cautious as some tools may have bugs that could potentially corrupt files during the decryption process.
2. Backup infected systems: Before reformatting drives or using any decryption tools, create a backup of all infected systems. This ensures you have a copy of the compromised files and can restore them if the chosen decryption tool fails or causes unintended issues.
3. Explore custom decryption solutions: If the free tools are unsuccessful, some companies offer custom-built decryption solutions for specific ransomware variants. Consider reaching out to them for assistance.
4. Collaboration with law enforcement: In some cases, law enforcement agencies may apprehend the ransomware operators and gain access to the decryption keys. Stay informed about ongoing investigations and collaborate with authorities if applicable.
5. Capture memory dump: If the ransomware script is still running, consider capturing a memory dump to record any malicious processes. This information can aid in understanding the encryption method and potentially facilitate the decryption process.

By following these steps, you can explore various options to recover your files and gain insights into the ransomware attack while preserving important evidence for analysis.

Step 7: Identify the Strain

 

To increase the likelihood of decrypting your files without paying the ransom, it is important to determine the specific strain of ransomware that has infected your systems. You can use online ransomware identification tools such as ID Ransomware, Emsisoft, and No More Ransom. These tools allow you to upload a ransom note or a sample encrypted file, and they will provide information on the ransomware strain.

By identifying the specific strain, you can gather valuable information on the encryption method used, available decryption options, and any known vulnerabilities or decryption tools associated with that strain. This knowledge can help you explore more targeted solutions or decryption methods, potentially avoiding the need to pay the ransom and restoring your files more effectively.

Step 8: Decide Whether to Pay the Ransom

 

After exploring all available options and considering the potential consequences, you may find yourself in a difficult position where you need to decide whether to pay the ransom. This decision should not be taken lightly, as it carries inherent risks and ethical considerations. Consider the following factors:

1. Exhaust all alternatives: Ensure that you have exhausted all possible recovery options, such as utilizing decryption tools, seeking professional assistance, collaborating with law enforcement, and exploring custom decryption solutions. Only consider paying the ransom as a last resort.
2. No guarantee of decryption: Keep in mind that paying the ransom does not guarantee that your data will be decrypted. Attackers may choose not to honour their promises, leading to further financial loss and potential data exposure.
3. Encouragement of criminal activity: Paying the ransom incentivizes attackers to continue their malicious activities and develop more sophisticated strains. It perpetuates the ransomware ecosystem and poses a threat to others.
4. Unintended funding of criminal endeavours: By paying the ransom, you may inadvertently support other criminal activities, such as human trafficking or terrorism. Consider the broader implications of your actions.

Before making the decision to pay the ransom, consult with security professionals, legal advisors, and law enforcement agencies. They can provide guidance based on the specifics of your situation and help you weigh the potential risks and benefits. Ultimately, the decision should align with your organization’s values, legal obligations, and risk appetite.

To experience the capabilities of the Pulse Tech Corp Security services and understand how it can protect your data in the event of a ransomware attack, we invite you to schedule a demo with one of our skilled engineers. They will provide a comprehensive overview and demonstrate how it can safeguard your valuable information. Take proactive steps to protect your data and mitigate the risks of ransomware attacks by scheduling a demo with the managed service provider.