Incident Response and Digital Forensics
Ransomware Incident Analysis
We determine where the ransomware entered, how it spread, and whether data was exfiltrated before encryption. We provide evidence for which backup you can safely restore.
What it is
In ransomware attacks, encryption is typically the final step. The attacker first spreads in the network, escalates privileges, and in many cases exfiltrates data. Even a backup taken before encryption may contain the attacker's access. Therefore, the analysis traces back to the attacker's initial access, not just the moment of encryption.
Scope
- Identifying the initial access point (e.g., a VPN account without multi-factor authentication)
- Mapping the lateral movement path and compromised admin accounts
- Searching for evidence of data exfiltration before encryption
- Checking whether backups and the backup system were affected by the attack
- Identifying the nearest backup that can be safely used
- Identifying the ransomware family and checking for a free decryptor
The need
When organizations need it
- When systems started in the morning show changed file extensions and a ransom note.
- When the attacker sends a message threatening to release your data.
- When you need to know if a backup contains the attacker's access before restoring.
Method
How we work
-
Preservation
We collect memory, disk images, and logs from affected systems. We disconnect the backup system from the network.
-
Entry and spread
We create a timeline of the attacker's initial access, compromised accounts, and affected systems.
-
Exfiltration
We assess archiving traces, unusual outbound traffic, and cloud storage records for signs of data exfiltration.
-
Safe restore point
We determine which backup is clean based on the first access date and recommend the restore sequence.
Outcome
What you have at the end
You have evidence of where the attack began, where it spread, and whether data was exfiltrated. The backup to restore from and the order are clear.
Frequently asked questions
Should we pay the ransom?
This decision belongs to your organization and legal counsel. Payment does not guarantee the decryptor will work on all systems or that data will be deleted. We provide the technical facts needed for the decision, mainly the state of your backups and whether data was exfiltrated.
Can the encrypted files be decrypted?
Free decryptors exist for some ransomware families. We check for one after identifying the family. If none is available, recovery requires a clean backup.
Incident Response and Digital Forensics
Other services in this area
Let's talk about this service.
Tell us briefly what you need. We will agree on the scope and timing together in the first meeting.
Schedule a Meeting