Ransomware: risks and first response

Who this page is for

This page is for executives, IT and security leaders, crisis team members and anyone who wants to understand ransomware realistically - without hype and without attack guidance.

What ransomware is

Ransomware is malicious software that makes data inaccessible - typically by encryption - and demands payment for release or for keeping exfiltrated data private. In practice attackers combine encryption with data theft and double extortion.

Typical flow at a high level

1. Initial access via phishing, stolen credentials, vulnerabilities or suppliers.
2. Foothold on a system and reconnaissance.
3. Privilege escalation and lateral movement.
4. Data exfiltration for later extortion.
5. Encryption of core systems.
6. Extortion with the threat of disclosure.

This description supports understanding. Concrete attack guidance is intentionally not provided.

Early warning signs

Common signals in early phases:

- Unusual logins, especially from unexpected regions
- Bursts of failed MFA prompts
- New administrator accounts
- Unexpected scripts or tools on servers
- Atypical data movement, for example large transfers to cloud storage

Effective protective measures

- MFA, ideally phishing-resistant, especially at identity providers
- Patch management for externally exposed systems
- EDR with response capabilities
- Network and identity segmentation
- Backups, at least one offline or immutable, regularly tested
- Least privilege for administrators and service accounts
- Awareness with a clear reporting culture
- A rehearsed incident response plan

First steps when ransomware is suspected

1. Stay calm and invoke the incident response plan.
2. Isolate suspect systems but do not clean up too fast.
3. Engage forensics and preserve evidence.
4. Review identities, rotate tokens and passwords, strengthen MFA.
5. Involve legal, data protection, authorities and insurer.
6. Coordinate factual external communication.
7. Resume operations only when persistence is eliminated.

The question of payment

Payment is not a fix and can be legally problematic. Even after payment, data is often not fully recoverable and the risk of repeat attacks rises. The decision is made by management together with legal, authorities and insurer.

Practical scenario

An attack starts with a phishing mail. MFA blocks the initial login. Awareness, a simple reporting path and EDR ensure early detection. A tabletop six months earlier had rehearsed exactly this scenario. Damage: limited.