The first 24 hours of a ransomware incident: a decision timeline

Ransomware is the moment an intrusion becomes visible, not the moment it began. CISA's #StopRansomware Guide notes that a ransomware event may be evidence of an earlier, unresolved compromise, and that over time attackers have added data theft to encryption, threatening to publish what they took: the combination it calls double extortion. The first day is therefore three problems at once: an outage, an active intruder and a probable data breach. The timeline below is the order in which the decisions usually fall; the first-hour checklist is the printable version for the on-call team.

Hour 0 to 1: contain without destroying evidence

1. 1

   Name an incident lead and start a log

   One person decides; everyone else reports to them. Open a timestamped log of every action, who took it and why. It becomes the record you give to insurers, regulators and, if it comes to it, a court.

2. 2

   Move to out-of-band communication

   Assume email and chat are being read. CISA advises isolating systems in a coordinated way and using out-of-band methods such as phone calls, because attackers who notice the response may move laterally or deploy ransomware more widely before networks are taken offline.

3. 3

   Isolate at the network layer

   If several systems or subnets are affected, take the network offline at the switch level, as CISA's checklist puts it. Block outbound traffic at the firewall, disable VPN and other remote access, and cut links to other sites and to cloud environments. The goal is isolation, not shutdown.

4. 4

   Leave machines powered on

   Powering a device down destroys what is in volatile memory, which is often the best evidence of what ran. CISA recommends powering down only when a device cannot be disconnected from the network any other way.

5. 5

   Snapshot rather than terminate

   For cloud workloads, take snapshots of volumes to keep a point-in-time copy for investigation. Terminating an instance to stop the spread also deletes the evidence on it.

6. 6

   Protect the restore points

   Pause backup retention and synchronisation jobs so that clean restore points are not expired or overwritten with encrypted data, and check that nobody holding compromised credentials can delete them.

Hours 1 to 4: preserve, identify and scope

With the spread contained, the priority becomes evidence that is about to disappear, and then the three questions that shape every later decision: what is this, how did it get in, and what can it reach?

Preserve what is volatile or short-lived

Capture memory and a system image from a sample of affected machines, including servers and virtual and cloud hosts. Collect first the evidence most likely to roll over, which CISA lists as system memory, Windows Security logs and firewall log buffers, then add identity provider sign-ins, VPN logs and endpoint telemetry. Extend retention everywhere now, because default windows will expire mid-investigation, and hash what you copy so that chain of custody holds later.

Identify the strain

The ransom note, the encrypted file extension and the hash of the encryptor usually identify the family. That tells you how the group typically gets in, whether it is known for stealing data, and what tooling to hunt for. It also tells you whether recovery without payment might be possible: CISA advises asking law enforcement about decryptors, because researchers have sometimes found flaws in a variant's encryption and released tools, and the No More Ransom (opens in a new tab) project, started by the Dutch police's National High Tech Crime Unit, Europol's European Cybercrime Centre, Kaspersky and McAfee, exists to help victims recover data without paying.

Find the way in

Work outwards from the earliest confirmed evidence, then look earlier still. The routes to check first:

• Remote access: VPN appliances, remote desktop gateways and other internet-facing services, especially any without multi-factor authentication or behind on patches.
• Precursor malware: CISA names loaders such as Bumblebee, Dridex, Emotet and QakBot, whose operators will often sell the access they gain.
• Valid credentials used from unusual places or at unusual times, including those of suppliers with remote access.
• New or changed accounts: CISA's checklist points to newly created Active Directory accounts, recently escalated privileges and anomalous VPN logins.

Scope the identity compromise

Encrypting an estate at scale typically relies on domain-level or equivalent privileges, so assume privileged credentials are compromised until evidence says otherwise. Build the list: domain and enterprise administrators, service accounts, identity provider and cloud administrators, and hypervisor and backup console administrators. For each one, ask what it could reach. That list drives containment now and the credential resets later.

Hours 4 to 12: backups, communications and the legal clocks

Backups: reachable, intact and clean?

• Could the attacker reach the backups, over the same network or with the same credentials?
• Were backup copies, snapshots or the backup catalogue deleted or encrypted?
• Is the backup console's administrator account on the compromised list?
• Which restore point predates the intrusion, not just the encryption?
• How long does a restore of a critical system take, measured, in a clean network?

CISA's guide warns that precursor malware has to be identified before rebuilding from backups, to stop the compromise continuing. A restore taken from the wrong point brings the intruder back along with the data.

Communications

Brief leadership with facts and explicit unknowns, and resist pressure to estimate impact early. Prepare holding statements for staff, customers and partners before anyone asks. Tell staff which channel to use, not to discuss the incident on corporate systems or with the press, and how to report anything suspicious. Choose one spokesperson.

Notification clocks

Legal deadlines run from when you became aware, not from when the investigation ends. Agree that moment with counsel and write it down, then work out which of the regimes below apply to you.

Hours 12 to 24: the payment question and the recovery plan

By the end of the first day, leadership will be asked whether to engage with the attackers. CISA and its partner agencies do not recommend paying: payment does not guarantee that data will be decrypted, that systems will no longer be compromised, or that stolen data will not be leaked. Paying can also carry sanctions risk; the guide points to the US Treasury's Office of Foreign Assets Control advisory from September 2021.

Whatever the eventual decision, it belongs to leadership with counsel, the insurer and law enforcement, and it should rest on facts the responders can establish by then: whether backups make recovery possible without payment, what data was taken, and whether the attacker still has access. Decisions made before those facts exist tend to be the ones organisations regret.

The day should end with a written recovery plan: what will be restored, in what order, by whom, on which clean infrastructure, and what has to be true before each step starts.

The recovery order

Restore in dependency order, and eradicate before you restore. CISA's checklist calls for hunting both outside-in persistence, such as rogue accounts and backdoors on perimeter systems, and inside-out persistence, such as implants and misused administration tools, before systems are reconnected.

1. 1

   Build a clean recovery environment

   A separate network segment that only verified-clean systems may join. CISA's guidance says a recovery VLAN should contain only clean systems, so that restored machines are not reinfected.

2. 2

   Restore identity first

   Recover domain controllers and the identity provider to a known-good state, then reset privileged credentials, revoke sessions and tokens, and rotate cloud keys and API secrets. Microsoft's forest recovery guidance is to reset the krbtgt account password twice, waiting at least the maximum ticket lifetime between the resets, which is 10 hours by default.

3. 3

   Then the services everything depends on

   DNS, DHCP, time, certificate services, and logging and endpoint tooling, so that you can see what happens as the rest comes back.

4. 4

   Then the management plane

   Backup infrastructure, hypervisors and administration tools, rebuilt or restored with new credentials and multi-factor authentication.

5. 5

   Then business systems, in priority order

   Rebuild from known-good images or infrastructure-as-code templates and restore data from offline, encrypted backups, following a critical-asset list agreed in advance, starting with the services that matter for health and safety and for revenue.

6. 6

   Reconnect in stages, and declare the end deliberately

   Bring systems back in stages under close monitoring. Declare the incident over against criteria agreed beforehand, not when the last server boots.

The post-incident review

Hold the review within a few weeks, while memories and logs are fresh, and keep it blameless: the aim is to find the conditions that let the attack succeed, not the person who clicked. It should produce:

• A timeline from initial access to recovery, with the evidence behind each step.
• The root cause, and the control that would have stopped or detected the attack earliest.
• Which decisions were slow, and what information was missing when they were made.
• Whether each notification went out on time, and what regulators, insurers and customers asked for.
• Changes to identity, remote access, backups and logging, each with an owner and a date.
• Updates to the incident response plan, the contact lists and the retainer.
• A follow-up test, such as a penetration test or a compromise assessment, to confirm the fixes hold.

CISA's guide closes by encouraging organisations to share lessons learned and indicators of compromise with government partners or their sector's information-sharing body. Our breach archives show how the same failure points recur across public incidents, and our incident response team can run the review with you or lead the whole response.