If you’re handling remediation in-house, follow this six-step process to remediate ransomware attacks and protect yourself from another incident. We’ll also explain how incident response (IR) teams can help if your team doesn’t have the time or expertise to manage remediation hands on.
1. Isolate infected systems to stop lateral spread
In-house teams
First, stop the spread and minimize damage. Immediately disconnect Ethernet cables, turn off wifi and Bluetooth, and unplug external hard drives. While some suggest fully powering off your computer during this step, others suggest leaving it on so you don’t lose any evidence in temporary memory that would help with forensic analysis.
Then, disable all compromised accounts and block any suspicious processes or infrastructure. Activate your IR plans and notify your legal team.
IR firms
Depending on the firm you hire, IR teams might show up on site to handle affected endpoints, while others will do this remotely using Endpoint Detection and Response (EDR) software.
To manage compromised accounts, IR teams often terminate current sessions using Identity Threat Detection and Response (ITDR) software.
2. Identify the ransomware strain & scope of impact
In-house teams
Figure out what type of ransomware you’re dealing with to understand the potential scope of the damage. This diagnosis is critical to what comes next, so take care during this step. Certain software, like Rubrik’s Anomaly Detection and Dell PowerProtect and PowerStore, help spot the strain by reviewing encryption methods, network traffic, and file changes. Another clue is the ransom note. This often has tells or even signatures that explain who’s responsible for the breach.
IR firms
Many organizations don’t have the time or expertise to do this analysis in-house, so it’s better to hire an IR firm to do a proper forensic investigation.
Start by sending the IR team your ransom note. With it, they’ll have an idea of who’s responsible and how to respond. For example, maybe the attackers are well-known for using a specific encryption tactic. IR groups will know where to start when addressing it.
Then, they’ll typically run binaries or scripts in a secure sandbox with an EDR installed to understand the processes. If your IR firm can identify a pattern, they’ll tell you what signs to look for—like receiving emails from suspicious senders or getting unexpected attachments.
3. Threat hunting for ransomware persistence mechanisms
In-house teams
Persistence mechanisms keep the backdoor open for threat actors. Rather than re-exploiting vulnerabilities every time they want in, attackers can simply regain access through already compromised operating systems, applications, or accounts.
Finding these openings brings you one step closer to closing the door. Check for common red flags like:
- New or unexpected administrator accounts
- Web shells or other rogue web-facing scripts
- Cached or dumped credentials where they don’t belong
- Compromised or misused RMM tools
- Suspicious scheduled tasks, services, or autoruns that launch unknown binaries
- Backdoors disguised as legitimate software
IR firms
Now that the IR team knows what they’re looking for, they’ll comb through your network, logs, and backups to find indicators of the attack patterns they identified. This step gets complicated when attackers use built-in tools like PowerShell to perform seemingly normal administrative activities.
Log everything your IR team learns while threat hunting, and store all this information for future use. If you experience a ransomware attack like this again, you’ll know what to do. Huntress cybersecurity experts have been threat hunting for years using Managed EDR and a 24/7 AI-centric Security Operation Center (SOC), so experienced analysts can continuously threat hunt on your behalf and help you get ahead of attacker tradecraft.
4. Eradicate malware & revoke unauthorized access
In-house teams
Delete any compromised or unauthorized accounts, and scrub your systems of all the malicious software you identified. Malicious software removal tools (MSRTs) can detect and remove active malware, while antivirus platforms can flag malicious programs that aren’t currently running.
IR firms
Have the IR team run EDR and continue monitoring the system for a while to confirm there’s no residual evidence of attacker activity or tooling. A fresh perspective might catch something they missed.
Huntress’ 24/7 AI-centric SOC acts as your second pair of eyes, monitoring and responding to cyber attacks around the clock. Our team oversees every phase of ransomware response and guides you through removing ransomware safely before you start recovery.
5. Restore data from clean backups
In-house teams
Now that your network is rid of ransomware, it’s time to start restoring encrypted files. One by one, restore each device using hardened, air-gapped backups that have been thoroughly tested. After recovery, that device is ready to reconnect to the network, and you can move on to the next.
IR firms
Before restoring your systems, IR teams will review backups to make sure they predate the attack and weren’t encrypted during the incident. Once files have the all-clear, the team will then restore authentication infrastructure, primary business apps, and any supporting systems.
6. Validate systems are secure before returning to production
In-house teams
Once you’ve recovered all affected devices, run a full system check across your entire infrastructure. If your security team has the expertise to continue monitoring systems, have them pay special attention to anything resembling those patterns your IR team identified early, like suspicious credentials cropping up in caches or new web shells sprouting up where they aren’t supposed to. Then, isolate anything suspicious immediately and start again.
IR firms
Lean teams might need the IR firm’s support for this step. They’ll handle the system checks and might even run simulated attacks to see whether the security stack is doing its job.
