Performing Ransomware Response
When to Use
- Ransomware has been detected executing or file encryption is actively occurring
- Users report inability to open files with unfamiliar extensions appended
- A ransom note is discovered on one or more systems
- EDR detects mass file modification patterns consistent with encryption behavior
- Threat intelligence warns of an imminent ransomware campaign targeting the organization
Do not use for general malware incidents that do not involve file encryption or extortion; use malware incident response procedures instead.
Prerequisites
- Ransomware-specific incident response playbook reviewed and approved by executive leadership
- Tested and verified offline backup strategy with air-gapped or immutable copies
- Incident retainer with a specialized ransomware response firm (e.g., Mandiant, CrowdStrike Services, Kroll)
- Legal counsel pre-engaged for OFAC sanctions screening and regulatory notification
- Cyber insurance carrier contact information and policy coverage details
- Bitcoin/cryptocurrency analysis capability or third-party engagement for payment tracing
Workflow
Step 1: Detect and Confirm Ransomware
Validate that the incident is ransomware and determine the variant:
- Identify the ransomware by analyzing the ransom note filename, extension appended to encrypted files, and note content
- Upload the ransom note and a sample encrypted file to ID Ransomware (id-ransomware.malwarehunterteam.com)
- Check NoMoreRansom.org for available free decryptors
- Determine the ransomware deployment method from EDR/SIEM logs
- Identify the ransomware group (e.g., LockBit, BlackCat/ALPHV, Royal, Akira, Play)
Ransomware Identification:
━━━━━━━━━━━━━━━━━━━━━━━━━
Variant: LockBit 3.0 (Black)
Extension: .lockbit3
Ransom Note: README-LOCKBIT.txt
Tor Site: lockbit[redacted].onion
Deployment: Group Policy Object pushing ransomware.exe to all domain-joined systems
Initial Access: VPN credential compromise (no MFA)
Dwell Time: 12 days
Data Exfiltration: Yes - 47GB uploaded to MEGA via rclone prior to encryption
Step 2: Immediate Containment
Stop ransomware propagation before assessing damage:
- Priority 1: Disconnect affected network segments from core infrastructure (pull the network cable, not shutdown)
- Priority 2: Isolate all domain controllers immediately if GPO-based deployment is suspected
- Priority 3: Disable the compromised accounts used for deployment
- Priority 4: Block lateral movement protocols (SMB TCP/445, RDP TCP/3389, WinRM TCP/5985-5986)
- Priority 5: Preserve at least one encrypted system live (do not power off) for memory forensics
- Do NOT: Shut down encrypted systems; keep them powered on to preserve encryption keys in memory
Step 3: Assess Damage and Scope
Quantify the impact to inform recovery and business decisions:
- Count the number of encrypted systems (workstations, servers, domain controllers)
- Determine which business-critical systems and data are affected
- Verify backup integrity: check that backups were not encrypted, deleted, or corrupted
- Assess whether data exfiltration occurred (check for rclone, WinSCP, MEGA, cloud storage activity)
- Determine the ransom demand amount and payment deadline
- Check OFAC sanctions lists to verify the ransomware group is not a sanctioned entity (paying is legally risky)
Impact Assessment:
Encrypted Systems: 187 of 340 endpoints (55%)
Encrypted Servers: 12 of 28 (43%) - includes 2 file servers, 1 database server
Domain Controllers: 2 of 3 encrypted
Backup Status: Veeam repository intact (offline copy verified clean)
Data Exfiltration: Confirmed - 47GB to MEGA (file listing under analysis)
Ransom Demand: $2.5M in Bitcoin (72-hour deadline)
OFAC Screening: LockBit - not currently sanctioned entity (verify with counsel)
Step 4: Recovery Decision Matrix
Evaluate recovery options in consultation with legal, executive leadership, and cyber insurance:
| Option |
Pros |
Cons |
Recommended When |
| Restore from backup |
No payment, no legal risk |
Recovery time may be days |
Clean backups available |
| Free decryptor |
No payment, fast |
Rare availability |
Variant has published decryptor |
| Negotiate and pay |
Potentially faster |
No guarantee, legal risk, funds threat actors |
No backups, business survival at stake |
| Rebuild from scratch |
Clean environment |
Longest timeline, data loss |
Backups compromised, willing to accept data loss |
Step 5: Execute Recovery
Implement the chosen recovery strategy:
If restoring from backup:
- Build a clean isolated network segment for recovery operations
- Rebuild domain controllers first from clean media (do NOT restore DC backups older than the dwell time)
- Reset ALL user and service account passwords before joining any system to the new domain
- Restore servers in priority order: authentication, DNS, DHCP, then business-critical applications
- Restore workstations via reimaging, not file-level restore
- Restore data from verified clean backups to rebuilt file servers
- Reconnect to production network only after validation
If using a decryptor:
- Test the decryptor on a non-critical system first
- Decrypt in order of business priority
- Scan all decrypted systems for residual malware before reconnection
Step 6: Post-Ransomware Hardening
Implement controls to prevent recurrence:
- Enforce MFA on all remote access (VPN, RDP, cloud portals)
- Implement 3-2-1-1-0 backup strategy (3 copies, 2 media types, 1 offsite, 1 immutable, 0 errors)
- Deploy application whitelisting on servers
- Implement network segmentation between workstation and server VLANs
- Enable Protected Users security group for privileged accounts
- Disable NTLM authentication where possible
- Deploy LAPS (Local Administrator Password Solution) for local admin accounts
Key Concepts
| Term |
Definition |
| Double Extortion |
Ransomware tactic combining file encryption with data exfiltration and threat to publish stolen data |
| Immutable Backup |
Backup storage that cannot be modified or deleted for a defined retention period, protecting against ransomware targeting backups |
| OFAC Sanctions |
U.S. Office of Foreign Assets Control restrictions that may prohibit ransom payments to sanctioned entities or jurisdictions |
| Dwell Time |
Days the attacker was present before deploying ransomware; critical for determining which backups are clean |
| Ransomware-as-a-Service (RaaS) |
Criminal business model where ransomware developers lease their malware to affiliates who conduct attacks |
| Rclone |
Legitimate cloud sync tool commonly abused by ransomware operators for data exfiltration before encryption |
| 3-2-1-1-0 Backup Rule |
Backup strategy requiring 3 copies, 2 media types, 1 offsite, 1 immutable/air-gapped, and 0 errors in recovery testing |
Tools & Systems
- ID Ransomware: Online service to identify ransomware variant from ransom note or encrypted file sample
- NoMoreRansom.org: Europol-backed project providing free decryption tools for certain ransomware families
- Veeam / Commvault: Enterprise backup platforms with immutable repository and instant VM recovery capabilities
- KAPE: Rapid forensic triage collection from encrypted systems to determine initial access and dwell time
- Cado Response: Cloud-native forensics platform for investigating ransomware that affects cloud infrastructure
Common Scenarios
Scenario: LockBit 3.0 via Compromised VPN
Context: Attackers compromised VPN credentials (no MFA), spent 12 days performing reconnaissance, disabled antivirus via GPO, exfiltrated 47GB of data, and deployed LockBit 3.0 across the domain via GPO at 2:00 AM on a Sunday.
Approach:
- Disconnect all network segments at the core switch level
- Verify offline backup integrity (Veeam repository on immutable storage)
- Preserve two encrypted servers powered on for memory forensics
- Engage incident response retainer and cyber insurance carrier
- Begin recovery in isolated network: rebuild DCs, reset all passwords, restore in priority order
- Conduct forensic investigation in parallel to determine initial access and full adversary activity
Pitfalls:
- Restoring from backups that were created during the 12-day dwell time (may contain backdoors)
- Paying the ransom without OFAC screening and legal counsel review
- Reconnecting recovered systems to the production network before full password reset
- Not checking for data exfiltration, leaving the organization exposed to the extortion threat
Output Format
RANSOMWARE INCIDENT REPORT
===========================
Incident: INC-2025-1892
Ransomware Family: LockBit 3.0 (Black)
Date Detected: 2025-11-17T06:45:00Z
Initial Access: VPN credential compromise (no MFA)
Dwell Time: 12 days
IMPACT SUMMARY
Encrypted Systems: 187 endpoints, 12 servers
Business Impact: Full operations disruption
Data Exfiltrated: 47GB (finance, HR, legal documents)
Ransom Demand: $2.5M BTC (72-hour deadline)
Backup Status: Veeam immutable repository - CLEAN
RECOVERY APPROACH
Decision: Restore from backup (no ransom payment)
Recovery Start: 2025-11-17T10:00:00Z
DC Rebuild: Complete - 2025-11-17T18:00:00Z
Critical Systems: Restored - 2025-11-18T12:00:00Z
Full Recovery: Estimated 2025-11-21
CONTAINMENT TIMELINE
06:45 UTC - Ransomware detected by SOC analyst
07:00 UTC - Network segments disconnected
07:15 UTC - Incident commander activated IR plan
07:30 UTC - Backup integrity verification started
08:00 UTC - Memory forensics initiated on 2 live systems
10:00 UTC - Recovery operations commenced in clean room
POST-INCIDENT ACTIONS
1. MFA enforced on all VPN and remote access
2. 3-2-1-1-0 backup architecture implemented
3. Network segmentation between workstation/server VLANs
4. LAPS deployed for local administrator passwords
5. Regulatory notifications filed (GDPR 72-hour, state AG)
Source: mukul975/Anthropic-Cybersecurity-Skills → skills/performing-ransomware-response/SKILL.md
1---2name: performing-ransomware-response3description: 'Executes a structured ransomware incident response from initial detection through containment, forensic analysis, decryption assessment, recovery, and post-incident hardening. Addresses ransom negotiation considerations, backup integrity verification, and regulatory notification requirements. Activates for requests involving ransomware response, ransomware recovery, crypto-ransomware, data encryption attack, ransom payment decision, or ransomware containment. '4---5
6
7# Performing Ransomware Response
8
9## When to Use
10
11- Ransomware has been detected executing or file encryption is actively occurring
12- Users report inability to open files with unfamiliar extensions appended
13- A ransom note is discovered on one or more systems
14- EDR detects mass file modification patterns consistent with encryption behavior
15- Threat intelligence warns of an imminent ransomware campaign targeting the organization
16
17**Do not use** for general malware incidents that do not involve file encryption or extortion; use malware incident response procedures instead.
18
19## Prerequisites
20
21- Ransomware-specific incident response playbook reviewed and approved by executive leadership
22- Tested and verified offline backup strategy with air-gapped or immutable copies
23- Incident retainer with a specialized ransomware response firm (e.g., Mandiant, CrowdStrike Services, Kroll)
24- Legal counsel pre-engaged for OFAC sanctions screening and regulatory notification
25- Cyber insurance carrier contact information and policy coverage details
26- Bitcoin/cryptocurrency analysis capability or third-party engagement for payment tracing
27
28## Workflow
29
30### Step 1: Detect and Confirm Ransomware
31
32Validate that the incident is ransomware and determine the variant:
33
34- Identify the ransomware by analyzing the ransom note filename, extension appended to encrypted files, and note content
35- Upload the ransom note and a sample encrypted file to ID Ransomware (id-ransomware.malwarehunterteam.com)
36- Check NoMoreRansom.org for available free decryptors
37- Determine the ransomware deployment method from EDR/SIEM logs
38- Identify the ransomware group (e.g., LockBit, BlackCat/ALPHV, Royal, Akira, Play)
39
40```
41Ransomware Identification:
42━━━━━━━━━━━━━━━━━━━━━━━━━
43Variant: LockBit 3.0 (Black)
44Extension: .lockbit3
45Ransom Note: README-LOCKBIT.txt
46Tor Site: lockbit[redacted].onion
47Deployment: Group Policy Object pushing ransomware.exe to all domain-joined systems
48Initial Access: VPN credential compromise (no MFA)
49Dwell Time: 12 days
50Data Exfiltration: Yes - 47GB uploaded to MEGA via rclone prior to encryption
51```
52
53### Step 2: Immediate Containment
54
55Stop ransomware propagation before assessing damage:
56
57- **Priority 1**: Disconnect affected network segments from core infrastructure (pull the network cable, not shutdown)
58- **Priority 2**: Isolate all domain controllers immediately if GPO-based deployment is suspected
59- **Priority 3**: Disable the compromised accounts used for deployment
60- **Priority 4**: Block lateral movement protocols (SMB TCP/445, RDP TCP/3389, WinRM TCP/5985-5986)
61- **Priority 5**: Preserve at least one encrypted system live (do not power off) for memory forensics
62- **Do NOT**: Shut down encrypted systems; keep them powered on to preserve encryption keys in memory
63
64### Step 3: Assess Damage and Scope
65
66Quantify the impact to inform recovery and business decisions:
67
68- Count the number of encrypted systems (workstations, servers, domain controllers)
69- Determine which business-critical systems and data are affected
70- Verify backup integrity: check that backups were not encrypted, deleted, or corrupted
71- Assess whether data exfiltration occurred (check for rclone, WinSCP, MEGA, cloud storage activity)
72- Determine the ransom demand amount and payment deadline
73- Check OFAC sanctions lists to verify the ransomware group is not a sanctioned entity (paying is legally risky)
74
75```
76Impact Assessment:
77Encrypted Systems: 187 of 340 endpoints (55%)
78Encrypted Servers: 12 of 28 (43%) - includes 2 file servers, 1 database server
79Domain Controllers: 2 of 3 encrypted
80Backup Status: Veeam repository intact (offline copy verified clean)
81Data Exfiltration: Confirmed - 47GB to MEGA (file listing under analysis)
82Ransom Demand: $2.5M in Bitcoin (72-hour deadline)
83OFAC Screening: LockBit - not currently sanctioned entity (verify with counsel)
84```
85
86### Step 4: Recovery Decision Matrix
87
88Evaluate recovery options in consultation with legal, executive leadership, and cyber insurance:
89
90| Option | Pros | Cons | Recommended When |
91|--------|------|------|-----------------|
92| Restore from backup | No payment, no legal risk | Recovery time may be days | Clean backups available |
93| Free decryptor | No payment, fast | Rare availability | Variant has published decryptor |
94| Negotiate and pay | Potentially faster | No guarantee, legal risk, funds threat actors | No backups, business survival at stake |
95| Rebuild from scratch | Clean environment | Longest timeline, data loss | Backups compromised, willing to accept data loss |
96
97### Step 5: Execute Recovery
98
99Implement the chosen recovery strategy:
100
101**If restoring from backup:**
1021. Build a clean isolated network segment for recovery operations
1032. Rebuild domain controllers first from clean media (do NOT restore DC backups older than the dwell time)
1043. Reset ALL user and service account passwords before joining any system to the new domain
1054. Restore servers in priority order: authentication, DNS, DHCP, then business-critical applications
1065. Restore workstations via reimaging, not file-level restore
1076. Restore data from verified clean backups to rebuilt file servers
1087. Reconnect to production network only after validation
109
110**If using a decryptor:**
1111. Test the decryptor on a non-critical system first
1122. Decrypt in order of business priority
1133. Scan all decrypted systems for residual malware before reconnection
114
115### Step 6: Post-Ransomware Hardening
116
117Implement controls to prevent recurrence:
118
119- Enforce MFA on all remote access (VPN, RDP, cloud portals)
120- Implement 3-2-1-1-0 backup strategy (3 copies, 2 media types, 1 offsite, 1 immutable, 0 errors)
121- Deploy application whitelisting on servers
122- Implement network segmentation between workstation and server VLANs
123- Enable Protected Users security group for privileged accounts
124- Disable NTLM authentication where possible
125- Deploy LAPS (Local Administrator Password Solution) for local admin accounts
126
127## Key Concepts
128
129| Term | Definition |
130|------|------------|
131| **Double Extortion** | Ransomware tactic combining file encryption with data exfiltration and threat to publish stolen data |
132| **Immutable Backup** | Backup storage that cannot be modified or deleted for a defined retention period, protecting against ransomware targeting backups |
133| **OFAC Sanctions** | U.S. Office of Foreign Assets Control restrictions that may prohibit ransom payments to sanctioned entities or jurisdictions |
134| **Dwell Time** | Days the attacker was present before deploying ransomware; critical for determining which backups are clean |
135| **Ransomware-as-a-Service (RaaS)** | Criminal business model where ransomware developers lease their malware to affiliates who conduct attacks |
136| **Rclone** | Legitimate cloud sync tool commonly abused by ransomware operators for data exfiltration before encryption |
137| **3-2-1-1-0 Backup Rule** | Backup strategy requiring 3 copies, 2 media types, 1 offsite, 1 immutable/air-gapped, and 0 errors in recovery testing |
138
139## Tools & Systems
140
141- **ID Ransomware**: Online service to identify ransomware variant from ransom note or encrypted file sample
142- **NoMoreRansom.org**: Europol-backed project providing free decryption tools for certain ransomware families
143- **Veeam / Commvault**: Enterprise backup platforms with immutable repository and instant VM recovery capabilities
144- **KAPE**: Rapid forensic triage collection from encrypted systems to determine initial access and dwell time
145- **Cado Response**: Cloud-native forensics platform for investigating ransomware that affects cloud infrastructure
146
147## Common Scenarios
148
149### Scenario: LockBit 3.0 via Compromised VPN
150
151**Context**: Attackers compromised VPN credentials (no MFA), spent 12 days performing reconnaissance, disabled antivirus via GPO, exfiltrated 47GB of data, and deployed LockBit 3.0 across the domain via GPO at 2:00 AM on a Sunday.
152
153**Approach**:
1541. Disconnect all network segments at the core switch level
1552. Verify offline backup integrity (Veeam repository on immutable storage)
1563. Preserve two encrypted servers powered on for memory forensics
1574. Engage incident response retainer and cyber insurance carrier
1585. Begin recovery in isolated network: rebuild DCs, reset all passwords, restore in priority order
1596. Conduct forensic investigation in parallel to determine initial access and full adversary activity
160
161**Pitfalls**:
162- Restoring from backups that were created during the 12-day dwell time (may contain backdoors)
163- Paying the ransom without OFAC screening and legal counsel review
164- Reconnecting recovered systems to the production network before full password reset
165- Not checking for data exfiltration, leaving the organization exposed to the extortion threat
166
167## Output Format
168
169```
170RANSOMWARE INCIDENT REPORT
171===========================
172Incident: INC-2025-1892
173Ransomware Family: LockBit 3.0 (Black)
174Date Detected: 2025-11-17T06:45:00Z
175Initial Access: VPN credential compromise (no MFA)
176Dwell Time: 12 days
177
178IMPACT SUMMARY
179Encrypted Systems: 187 endpoints, 12 servers
180Business Impact: Full operations disruption
181Data Exfiltrated: 47GB (finance, HR, legal documents)
182Ransom Demand: $2.5M BTC (72-hour deadline)
183Backup Status: Veeam immutable repository - CLEAN
184
185RECOVERY APPROACH
186Decision: Restore from backup (no ransom payment)
187Recovery Start: 2025-11-17T10:00:00Z
188DC Rebuild: Complete - 2025-11-17T18:00:00Z
189Critical Systems: Restored - 2025-11-18T12:00:00Z
190Full Recovery: Estimated 2025-11-21
191
192CONTAINMENT TIMELINE
19306:45 UTC - Ransomware detected by SOC analyst
19407:00 UTC - Network segments disconnected
19507:15 UTC - Incident commander activated IR plan
19607:30 UTC - Backup integrity verification started
19708:00 UTC - Memory forensics initiated on 2 live systems
19810:00 UTC - Recovery operations commenced in clean room
199
200POST-INCIDENT ACTIONS
2011. MFA enforced on all VPN and remote access
2022. 3-2-1-1-0 backup architecture implemented
2033. Network segmentation between workstation/server VLANs
2044. LAPS deployed for local administrator passwords
2055. Regulatory notifications filed (GDPR 72-hour, state AG)
206```
207
208---
209
210**Source:** [`mukul975/Anthropic-Cybersecurity-Skills`](https://github.com/mukul975/Anthropic-Cybersecurity-Skills) → `skills/performing-ransomware-response/SKILL.md`
thedixitjain