Playbook: the first 24 hours of a ransomware incident

First hour

Declare the incident and assemble the team using out-of-band communication. Isolate affected hosts from the network using EDR network containment or switch ports rather than powering them off, so memory is preserved. Disable or segment connections to backups immediately, and check that backup consoles and storage have not been accessed or deleted. Preserve a ransom note and one encrypted file sample.

Protect identity and control planes

Ransomware operators usually gain domain admin or equivalent before encrypting. Reset privileged credentials from a clean workstation, including the KRBTGT account twice with replication time in between if domain compromise is suspected. Review new admin accounts, Group Policy changes, and remote management tools. Lock down hypervisor management consoles, which are frequent targets.

Lab: tabletop the first day

Run a tabletop with your team using this inject sequence: 06:10 helpdesk receives calls about files renamed with a new extension; 06:30 EDR shows encryption on two file servers; 07:00 the backup admin cannot log in to the backup console; 09:00 a leak site lists your company name. At each inject, decide actions, owners, and communications. Record decisions you could not make because information or authority was missing.

Snippet

Checklist (first 24h)
[ ] Incident declared, out-of-band channel active
[ ] Affected hosts isolated (not powered off)
[ ] Backups disconnected and verified intact
[ ] Privileged credentials reset from clean device
[ ] Ransom note + encrypted sample preserved
[ ] Scope: encrypted systems list, patient zero candidates
[ ] Exfiltration check: large outbound transfers, cloud storage uploads
[ ] Legal, insurer, leadership briefed; law enforcement contact considered
[ ] Recovery plan drafted: priorities, clean rebuild, restore testing

Scoping and recovery

Identify initial access (often exposed remote access, phishing, or an unpatched edge device), the spread mechanism, and whether data was exfiltrated, which changes legal obligations. Recovery means rebuilding or restoring from known-good backups into a clean environment, in business priority order, while monitoring for the attacker’s return. Payment decisions involve leadership, legal counsel, insurers, and sanctions checks; the technical team’s job is to provide accurate facts.

Diagram

Ransomware first 24 hours

Isolate
Contain hosts via EDR or network; keep them powered on.
Protect
Disconnect and verify backups; secure identity and hypervisor consoles.
Scope
Encrypted systems, initial access, and exfiltration.
Plan recovery
Clean rebuild, restore by priority, monitor for return.

Check yourself

1. Why isolate rather than power off encrypted hosts?

2. Which systems should be protected first after isolation?

3. Why does it matter whether data was exfiltrated?