An encrypted file and a ransom note do not yet tell you where the incident began, how many hosts it reached, or whether the intruder still has access. The first hour is for limiting damage and recording facts. It is not the time to promise that “it is over”.
Start with a decision owner and a clock
Record the report time with its timezone, the reporter, hostname, visible symptom, and anything already done. Separate:
- fact: “at 09:14, file
Xgained a new extension onPC-12”; - hypothesis: “the ransomware arrived through email”;
- gap: “we do not know whether the file server is affected”.
Name the person who may decide on isolation, service interruption, and outside contact. Without that owner, several people may power off equipment, delete files, and reset accounts at the same time without a shared timeline.
Contain the spread and preserve the disk
Disconnect a suspect host from the network: cable, Wi-Fi, switch port, or an isolation function in the management tool. Do not open email on it, run a “cleaner”, or sign in with a privileged account. Isolation should break communication without erasing local state.
Do not automatically power off every computer. Shutdown removes volatile memory and may make it harder to identify running processes, connections, or keys. On the other hand, if encryption is actively continuing and the host cannot quickly and safely be isolated from the network or storage, a controlled shutdown may limit further damage. Record the decision: who made it, when, what was visible, and why isolation or shutdown was selected.
Do not indiscriminately disconnect servers, storage arrays, and network devices. The consequences for services and evidence differ from those for one workstation. If you lack the authority or skill, escalate instead of experimenting.
Accounts, shares, and backups
Check which shares were available to the suspect host and whether new changes are appearing. Restricting write access or disconnecting an exposed share should be a service owner’s decision, with the time and business impact recorded.
Accounts suspected of compromise may require sessions or tokens to be revoked and credentials reset. Do not perform the reset from an infected computer. Start with privileged accounts and accounts used on affected hosts, while preserving logs and recording every change.
Do not connect a backup to the suspect environment “to see whether it works”. First separate the repository. Identify the newest restore point that available evidence shows predates the unwanted changes, and record its verification status. Restoring before defining scope may expose the backup again or overwrite data you need.
What to preserve
- a photo of the screen with the hostname and time, if it can be taken without clicking through the system;
- the ransom note and names of example encrypted files, without running attached programs;
- available logs from network devices, identity services, email, VPN, servers, and security controls;
- an action timeline: isolation, shutdown, account block, share change, and outside contact;
- a list of gaps and systems not yet checked.
Do not call the environment “clean” because the note was found on one computer. An honest update says: “we have confirmed the symptom on two hosts; the scope across email, VPN, and backups is still unknown”.
The next step
The IR checklist structures intake and decisions, the first-hour decision card holds operational details, and the basic digital forensics worksheet separates observations from hypotheses. The incident response lab shows the practice environment.
CISA publishes a broader, current workflow in its #StopRansomware Guide. Reporting, insurance, and legal obligations depend on the organisation and jurisdiction; this article does not determine them.