Ransomware first-hour decision drill
A ransom note appears on a file server at 02:14. Make five decisions in order, from containment to recovery, and see what each choice costs.
Goal
You are the on-call incident lead for a mid-sized company. A ransom note has just appeared on the main file server, and every decision in the next few hours changes how long the business is down.
Work through the five decisions in order. Each wrong option tells you what it would have cost, so you can learn from it and choose again.
- 02:14
The night operator reports a ransom note on file server FS-01. Shared folders are filling with files renamed to *.lockd.
Decision needed: what do you do first? Answer in step 1 below.
- 02:31
EDR shows the same encryptor starting on HR-07 and APP-03. Every launch runs as the domain account svc-backup over remote service creation.
- 03:05
The backup server BK-01 is domain-joined and svc-backup is a local admin there. Its catalogue shows two deleted restore points tonight.
- 03:40
Containment is holding. Leadership is asleep, and the HR server held employee records.
- 06:00
The response firm finds the attacker’s first foothold, a VPN account without MFA, and a scheduled task on six servers.
Steps
0102:14 — What do you do first?
0202:31 — What is the next containment step?
0303:05 — Before any restore, what do you check?
0403:40 — Who do you bring in now?
0506:00 — How do you bring the servers back?