Ransomware First Response
The first hour decides how bad a ransomware or malware incident gets. Panic leads to the wrong moves — paying immediately, wiping evidence, or reconnecting an infected machine and spreading it. This gives a calm, correct sequence: isolate, preserve your options, and recover from the safest source — while being honest that a serious business incident needs professional responders.
What This Skill Produces
- Immediate containment — disconnect from networks and shared drives to stop spread, without destroying recovery options
- Preserve evidence & options — don't wipe or pay reflexively; photograph the ransom note, note timing, keep the door open
- The recovery path — restore from clean offline backups, check for a known/legitimate decryptor, or engage a professional
- The payment decision — the honest tradeoffs and risks of paying (no guarantee, funds crime, marks you as payer)
- Reporting — the authorities/agencies to notify, and (for orgs) any breach-notification duties
- A scope flag — personal/small setup vs. a business incident that needs real incident-response help
Required Inputs
Ask for these if not provided:
- What you're seeing — ransom note, encrypted/renamed files, pop-ups, or just suspicious behavior
- The setup — personal device, home network, or a business/multi-device environment
- Backups — do you have recent offline/cloud backups, and are they disconnected
- Spread — is it one device or possibly shared drives/other machines
- Sensitivity — is sensitive/regulated data involved
Framework: Isolate, Preserve, Recover — Don't Panic
- Isolate now. Disconnect the device from Wi-Fi/network and unplug shared/external drives to stop encryption from spreading — but don't start deleting.
- Don't destroy your options. Don't wipe, don't reformat yet, and don't pay on impulse. Photograph the ransom note and record what/when you noticed.
- Recover from clean backups. The best outcome is wiping and restoring from a known-good offline backup — verify it wasn't connected during infection.
- Check for legitimate decryptors. Some ransomware strains have free, reputable decryptors via official security projects — check before considering payment.
- Weigh payment honestly. Paying is risky: no guarantee of recovery, it funds criminals, and it flags you. Treat it as a last resort, ideally with professional advice.
- Report and, if serious, get help. Notify the relevant authorities; for a business or sensitive-data incident, engage professional incident response and check notification duties.
Output Format
Suspected [ransomware/malware] · [personal/business] · backups: [yes/no]
Now (first minutes)
- Disconnect network + unplug external/shared drives.
- Don't wipe, don't pay yet. Photograph the ransom note; note time/first sign.
- Isolate any other devices that share the network/drives.
Recover: wipe + restore from a clean offline backup → or check for a legitimate free decryptor → or engage a professional.
Payment: last resort, high risk — [tradeoffs]; get advice first.
Report: [relevant authority/agency] · [breach-notification duties if applicable].
This is first-response guidance for a personal/small setup. A business incident, or anything with sensitive/regulated data, needs professional incident responders — engage them early.
Quality Checks
Anti-Patterns
- Paying immediately out of panic.
- Reformatting/wiping before preserving evidence and confirming backups.
- Reconnecting the infected device and spreading it.
- Restoring from a backup that was connected during infection.
- Treating a serious business breach as a DIY job.
Example Trigger Phrases
- "My files are all encrypted and there's a ransom note — what do I do?"
- "I think I've got ransomware, help me not make it worse."
- "Suspicious pop-up locked my computer demanding payment."
- "Should I pay the ransom to get my files back?"
- "Malware on my work laptop — what's my first move?"
1---2name: ransomware-first-response3description: Handle the first hour of a suspected ransomware or malware infection calmly and correctly — contain it, preserve options, and avoid the moves that make it worse. Use when asked what to do about ransomware, my files are encrypted with a ransom note, I think I have malware, or my computer's been hacked. Produces an immediate containment checklist, a preserve-evidence-and-options step, a recovery path (backups, known decryptors, professional help), guidance on the ransom-payment decision, and reporting steps — for personal/small-setup use, not a substitute for professional incident response.4---5
6# Ransomware First Response
7
8The first hour decides how bad a ransomware or malware incident gets. Panic leads to the wrong moves — paying immediately, wiping evidence, or reconnecting an infected machine and spreading it. This gives a calm, correct sequence: isolate, preserve your options, and recover from the safest source — while being honest that a serious business incident needs professional responders.
9
10## What This Skill Produces
11
12- **Immediate containment** — disconnect from networks and shared drives to stop spread, without destroying recovery options
13- **Preserve evidence & options** — don't wipe or pay reflexively; photograph the ransom note, note timing, keep the door open
14- **The recovery path** — restore from clean offline backups, check for a known/legitimate decryptor, or engage a professional
15- **The payment decision** — the honest tradeoffs and risks of paying (no guarantee, funds crime, marks you as payer)
16- **Reporting** — the authorities/agencies to notify, and (for orgs) any breach-notification duties
17- **A scope flag** — personal/small setup vs. a business incident that needs real incident-response help
18
19## Required Inputs
20
21Ask for these if not provided:
22- **What you're seeing** — ransom note, encrypted/renamed files, pop-ups, or just suspicious behavior
23- **The setup** — personal device, home network, or a business/multi-device environment
24- **Backups** — do you have recent offline/cloud backups, and are they disconnected
25- **Spread** — is it one device or possibly shared drives/other machines
26- **Sensitivity** — is sensitive/regulated data involved
27
28## Framework: Isolate, Preserve, Recover — Don't Panic
29
301. **Isolate now.** Disconnect the device from Wi-Fi/network and unplug shared/external drives to stop encryption from spreading — but don't start deleting.
312. **Don't destroy your options.** Don't wipe, don't reformat yet, and don't pay on impulse. Photograph the ransom note and record what/when you noticed.
323. **Recover from clean backups.** The best outcome is wiping and restoring from a known-good *offline* backup — verify it wasn't connected during infection.
334. **Check for legitimate decryptors.** Some ransomware strains have free, reputable decryptors via official security projects — check before considering payment.
345. **Weigh payment honestly.** Paying is risky: no guarantee of recovery, it funds criminals, and it flags you. Treat it as a last resort, ideally with professional advice.
356. **Report and, if serious, get help.** Notify the relevant authorities; for a business or sensitive-data incident, engage professional incident response and check notification duties.
36
37## Output Format
38
39### Suspected [ransomware/malware] · [personal/business] · backups: [yes/no]
40
41**Now (first minutes)**
421. Disconnect network + unplug external/shared drives.
432. Don't wipe, don't pay yet. Photograph the ransom note; note time/first sign.
443. Isolate any other devices that share the network/drives.
45
46**Recover:** wipe + restore from a clean *offline* backup → or check for a legitimate free decryptor → or engage a professional.
47**Payment:** last resort, high risk — [tradeoffs]; get advice first.
48**Report:** [relevant authority/agency] · [breach-notification duties if applicable].
49
50> This is first-response guidance for a personal/small setup. A business incident, or anything with sensitive/regulated data, needs professional incident responders — engage them early.
51
52## Quality Checks
53- [ ] Containment (disconnect network/drives) is the first action
54- [ ] Warns against wiping or paying reflexively; preserve evidence
55- [ ] Prioritizes restoring from a verified offline backup
56- [ ] Mentions checking for legitimate free decryptors before payment
57- [ ] Presents the payment decision honestly as a risky last resort
58- [ ] Includes reporting and flags when to get professional IR help
59
60## Anti-Patterns
61- **Paying immediately** out of panic.
62- **Reformatting/wiping** before preserving evidence and confirming backups.
63- **Reconnecting the infected device** and spreading it.
64- **Restoring from a backup** that was connected during infection.
65- **Treating a serious business breach** as a DIY job.
66
67## Example Trigger Phrases
68- "My files are all encrypted and there's a ransom note — what do I do?"
69- "I think I've got ransomware, help me not make it worse."
70- "Suspicious pop-up locked my computer demanding payment."
71- "Should I pay the ransom to get my files back?"
72- "Malware on my work laptop — what's my first move?"
gabrielmoreira