Warning: What follows is an example of a real-life ransomware attack and the resulting incident response.
Picture this: you’re cruising through your usual workday, coffee in hand, inbox under control, when suddenly ring! ring! you get a call from a co-worker. They can’t access a file on the shared drive. Odd, but manageable… right?
You try to open the file yourself, only to notice something strange. The familiar icons Word, PDF, Excel are gone. In their place? Blank, unrecognizable symbols. You double-click, hoping it’s just a glitch or your computer is having a stroke from Chrome eating all your memory. Nothing opens.
Then you spot it: every file extension ends in “. lukitus.” That’s not normal.
Digging deeper, you find a mysterious .htm file, conveniently associated with Chrome. You open it, and what you read sends a chill down your spine…
At this point, you might be thinking there’s only one logical move as an IT technician: print your résumé and start fresh somewhere far, far away. Kidding! (Although that would definitely give your boss a heart attack and that’s not the kind of impact we’re aiming for.)
So, what should you do?
Most people’s instinct is to dive headfirst into chaos. But before you touch a single keyboard or mouse, take a breath. The very first thing you should do is notify your team and formulate a game plan. Ideally, you’ve got an up to date Incident Response Plan ready to go. If so, follow it to the letter.
But let’s be honest this is real life, and in this scenario, the only copy of that plan was stored on the shared drive… which is now encrypted. Oops.
So now, you’re starting from scratch.
Ransomware attacks come in all shapes and sizes. Over the years, I’ve seen everything from highly sophisticated exploits to attacks that look like they were put together during someone’s lunch break. That’s why the first thing I always do is verify whether the files are actually encrypted.
Believe it or not, I’ve encountered cases where the attacker simply changed all the file extensions. No encryption, no malware just a sneaky rename job. In those cases, I “recovered” the data by restoring the original extensions. Voilà! Instant hero. Let’s go!
Then there was the time attackers used a remote access tool with the admin password set to wait for it, passwordpassword1. No fancy malware here. They just enabled BitLocker on every machine and removed the recovery keys. Low-tech? Yes. Effective? Unfortunately, yes.
But let’s assume this time it’s the real deal. The files are encrypted, the ransom note is clear, and you’ve opened the provided link in your Onion browser. You’re now staring at a chat prompt, and the first thing you see is…
The first thing you might notice in the chat window? That iconic “Anonymous Hacker” mask staring back at you as the avatar. Yep, this is real screen capture from my conversation. A live ransomware chat session between me and the infamous cybercriminal group known as LockBit. Buckle up.
Once you’re face-to-face (well, screen-to-screen) with the ransomware chat prompt, your next move is critical: upload one of your most important encrypted files and ask them to decrypt it. Most legitimate ransomware groups (yes, that’s a thing now) will decrypt one or two files to prove they actually have the keys.
Do not skip this step. There are plenty of copycat groups out there who have the ransomware tools but not the actual decryptors. If they don’t ask you to upload a test file, do it anyway. I’ve done this many times, usually with a line like, “Alright, hacker man, if you’re so good, let’s see you decrypt this.” If they can’t, well, that tells you everything you need to know.
Once you’ve confirmed they have working decryption tools, it’s time to make a plan: to pay or not to pay.
If you decide to pay, be warned, getting your hands on Bitcoin for the first time can be a bit of a headache. I highly recommend working with someone who’s been through the process before. The last thing you want is a delay that gives the attackers an excuse to stall or escalate the price.
Now, during this part of the incident response engagement, I often get asked two big questions:
If you’re not paying, it’s time to play defense and play it smart. First, slow-roll the conversation with the attackers. Keep them talking while you investigate how they got in.
I’ve seen too many cases where a company says, “We’ve rebuilt everything, we’re good now.” Then two weeks later: “Uhh… they deleted our backups.” Yep, second attacks happen more often than you’d think. Part of your Incident Response Plan should include a post-breach assessment to make sure the attack doesn’t happen again.
Start with an external penetration test. You need to know if there are still holes in your network. If vulnerabilities are found, patch them immediately and begin rebuilding your infrastructure with security in mind.
Bonus Tip: Shodan Says Hello
While you’re at it, go ahead and check your external IP address on Shodan.io. Think of it as the search engine for exposed devices on the internet basically, the Google of “oops, we left that open.”
Shodan scrapes and stores historical data about your external infrastructure, which can be incredibly handy (or horrifying) during an investigation.
True story: I once ran a pen test where a tech confidently told me, “Port 3389 has never been open.” (That’s Remote Desktop Protocol, for the uninitiated.) I pulled up Shodan, showed him a month-long history of it being wide open, and hit him with a friendly “Gotcha!” It was a mic-drop moment professional, of course.
Next, check your firewall logs. You might be surprised—over half of the environments I’ve worked in only retain logs for 7 days (the default setting on many firewalls). If that’s you, maybe go check that right now.
Once you have the logs, look for signs of data exfiltration—IP addresses, transfer volumes, timestamps. This helps confirm whether the attackers are bluffing about stealing your data.
For example, I had a client hit with ransomware where 80GB of data was exfiltrated. Sounds bad, right? But after digging into the logs, our Incident Response team found it was just an old IT directory full of freeware and tools, nothing sensitive. In that case, we stood down and didn’t engage further with the attackers.
If your firewall logs confirm that sensitive data has been exfiltrated, it’s time to start feeding that information to your legal counsel and executive leadership. Yes, it’s officially above your pay grade now but your job is far from over.
At this point, the C-suite needs to step in and make some big decisions. One of the first things they should do? Dust off those contracts—the ones with clients, employees, and vendors. Hopefully, there’s a data breach clause in there (and if not, well… add that to your post-incident to-do list). These clauses typically outline what needs to be communicated, to whom, and when. And yes, the requirements can vary wildly between customers, staff, and third parties because why make anything simple? Welcome to contracts, ha!
Meanwhile, because multitasking is the name of the game you should be scanning your environment for signs of the ransomware still lurking around. You should be using a variety of vendor tools to make sure you are not dealing with an active command and control (C2) situation. Because nothing says “bad day” like attackers still having a live connection into your network.
Once you identify the files or processes being used to maintain that C2 connection, push out updates across your environment using your remote management tools. Think of it as cutting the puppet strings before the puppet master gets creative.
In some cases, the damage is so extensive that our Incident Response team had to build an entirely new domain. Yep, scorched earth style. We slowly migrate clean devices over, enforce strong passwords, enable MFA (multi-factor authentication), and make sure everything is patched and running a solid EDR (end-point detection response) solution. Honestly, it’s often faster (and less frustrating) than playing whack-a-mole with a persistent attacker.
Lessons Learned (The Hard Way)
To avoid becoming a repeat customer of ransomware operators, here are a few must-dos:
The Alarming Reality of Voice and Video Impersonation Attacks In an increasingly digital world, the lines between what’s real and what’s fake are blurring at an alarming rate. One striking example ...
