The First 60 Minutes
When ransomware is detected, the first hour determines whether you lose one server or your entire network. Every minute of delay allows encryption to spread, backups to be targeted, and data to be exfiltrated.
Minute 0-5: Detection and Confirmation
Confirm the Incident
- Verify it's actual ransomware (not a false positive or test)
- Identify the ransom note and ransomware variant
- Note the first affected system and timestamp
- Activate the incident response team
Initial Assessment
- How many systems are affected?
- Is encryption still actively spreading?
- Are backup systems accessible?
- Is data exfiltration occurring?
Minute 5-15: Containment
Network Isolation
Priority 1: Stop the spread.- Isolate affected network segments at the switch/firewall level
- Disconnect compromised systems from the network (pull cables, disable WiFi)
- Block lateral movement protocols (SMB/445, RDP/3389, WMI/135)
- Do NOT power off encrypted systems (preserve volatile memory)
Protect Backups
- Verify backup systems are not compromised
- Disconnect backup storage from the network
- Verify most recent clean backup availability
Minute 15-30: Assessment
Scope Determination
- Identify all affected systems and file shares
- Determine ransomware variant (check ransom note, file extensions)
- Assess whether data exfiltration occurred (check network logs)
- Check for persistence mechanisms
Communication
- Notify CISO and executive leadership
- Engage incident response retainer if available
- Brief legal counsel on potential regulatory obligations
- Prepare internal communications
Minute 30-60: Strategy
Recovery Decision
Based on assessment:- Restore from backup: Clean systems, restore data (preferred)
- Decryptor available: Check No More Ransom project
- Negotiate/Pay: Last resort, involves legal and insurance
Evidence Preservation
- Image affected systems before any recovery
- Preserve network logs and firewall data
- Document the ransom note and all communications
- Maintain chain of custody for potential law enforcement
Post-Incident
- Complete root cause analysis
- Patch the initial entry vector
- Implement additional controls to prevent recurrence
- File regulatory notifications as required
- Conduct lessons learned session
SuperClue Ransomware Response
SuperClue's SOC agent detects ransomware indicators, active response on Linux and Windows can isolate the host, and you can build containment playbooks that start automatically, with CERT-In incident record-keeping.