If you discover ransomware, immediately isolate affected systems, preserve evidence, and activate your incident response plan. Disconnect infected devices from the network rather than powering them off when possible, since a hard shutdown can wipe out memory evidence investigators need later. Notify your incident response team and leadership right away, and lean on established guidance from CISA and the FBI, or bring in a partner like us if you need hands-on help fast.
TL;DR:
- Inventory endpoints, servers, cloud volumes, and network segments, then review EDR, VPN, Active Directory, and security logs for attacker activity and precursor malware.
- Disconnect infected devices from the network instead of shutting them down when possible, because a hard shutdown can erase memory evidence investigators need.
- When multiple subnets show infection, take the network offline at the switch level; for one affected host, disconnect it while preserving memory.
- Notify IT and senior leaders within the first hour; involve legal counsel, alert backup owners, and report the incident to CISA or the FBI.
- Keep three data copies across two media types, with one copy offsite and one immutable or offline, and confirm zero errors through regular restore testing.
Table of Contents
- Detect and Analyze the Scope of the Attack
- Who to Notify and When
- Containment and Forensic Preservation
- Rebuilding and Restoring Systems Safely
- Practical Steps for SMBs: Checklist and the 3-2-1-1-0 Backup Rule
- Why Ransomware Recovery Means Rebuilding, Not Just Decrypting
- How We Help After a Ransomware Attack
- FAQ
- Sources
Detect and Analyze the Scope of the Attack
Before you can recover, you need to know exactly what the ransomware touched. Start with a fast inventory of every endpoint, server, cloud volume, and network segment that could be in scope, then narrow down which ones show active signs of compromise.
Your logs tell the story of how the attacker got in and how far they moved. Pull data from your EDR platform, antivirus console, IDS/IPS, VPN concentrator, Active Directory, and any cloud snapshot history you keep. Look for precursor malware that commonly sets the stage for ransomware, including Emotet, QakBot, and Cobalt Strike, along with suspicious use of built-in admin tools like vssadmin or wmic, which attackers frequently abuse to delete shadow copies before deploying the final payload.
- Build a quick list of every endpoint, server, and cloud resource that might be affected.
- Check EDR, antivirus, IDS/IPS, VPN, and Active Directory logs for unusual activity.
- Watch for known precursor malware and abuse of administrative tools.
- Snapshot cloud volumes immediately so you preserve a forensic copy before making changes.
According to CISA's #StopRansomware guidance, you should determine which systems were impacted and isolate them immediately, taking the network offline at the switch level if multiple subnets show signs of compromise, and powering down devices only when disconnecting them from the network isn't possible.
Who to Notify and When
Speed matters here, but so does sequence. Internal stakeholders need to hear from you before rumors spread, and external partners and regulators often have reporting windows you can't afford to miss.
- Alert your IT lead or CISO and senior leadership within the first hour of confirmed detection.
- Loop in legal counsel to assess breach notification obligations tied to your industry and location.
- Notify your backup and infrastructure owners so they can begin verifying backup integrity.
- Report the incident to CISA and the FBI's Internet Crime Complaint Center, since both may request logs, ransom notes, and transaction identifiers if a ransom demand was made.
- Keep staff and customer communications factual and limited in detail, avoiding specifics that could tip off the attacker that you're actively hunting them inside your network.
Containment and Forensic Preservation
Containment and evidence preservation happen together, not one after the other. The goal is to stop the spread without destroying the clues that explain how the attacker got in and what they touched.
When several subnets show infection, taking the network offline at the switch level is often faster and safer than chasing down individual hosts one at a time. For isolated single-device infections, disconnecting that host from the network, rather than shutting it down, keeps volatile memory intact for analysis.
- Collect system images and memory captures from affected devices before rebuilding anything.
- Preserve relevant logs, ransom notes, and any samples of precursor malware for forensic review.
- Hunt for new or modified Active Directory accounts, anomalous VPN or RDP sessions, and unexpected use of administrative tools.
- Disable remote access temporarily, isolate backup targets from the production network, and stand up a clean recovery VLAN.
The #StopRansomware Guide recommends taking system images and memory captures before rebuilding, since this evidence is often the only way to confirm the attacker is fully removed rather than just dormant.
Pro Tip: Hibernate a suspect machine instead of shutting it down when you need to preserve memory for forensic review; a cold reboot can erase the evidence you need most.
If your environment runs VMware ESXi hosts, CISA's ESXiArgs recovery guidance includes a recovery script and step-by-step instructions for reconstructing VM configuration files and re-registering virtual machines affected by that specific ransomware variant.
Rebuilding and Restoring Systems Safely
Recovery starts with priorities, not with the first backup you can find. Work from a predefined critical asset list that ranks systems by safety impact, revenue impact, and core business function, and restore in that order.
- Rebuild servers and endpoints from standard images or infrastructure-as-code templates rather than attempting to clean infected machines in place.
- Stand up an isolated recovery VLAN so rebuilt systems never touch production until you've confirmed they're clean.
- Restore data only from immutable or offline backups, since online, connected backups are a common ransomware target.
- Run checksum verification or test restores before reconnecting any restored system to your live network.
- Reset all credentials, apply outstanding patches, enable multifactor authentication, and hunt for persistence mechanisms the attacker may have planted.
CISA's recovery guidance recommends rebuilding cloud resources using infrastructure-as-code templates to cut down on human error and speed up safe redeployment on an isolated network.
NIST guidance emphasizes that organizations exercising their incident response plans ahead of time recover faster, since defined decision-making roles and out-of-band communication plans remove guesswork during a live incident.
Treat ransomware as the final stage of a longer campaign rather than an isolated event. If the attacker had access long enough to deploy ransomware, assume they also attempted credential theft or data exfiltration, and build your post-recovery hardening around that assumption rather than just the ransomware payload itself.
Practical Steps for SMBs: Checklist and the 3-2-1-1-0 Backup Rule
A printable checklist with named owners and time targets turns a chaotic first hour into a manageable one. Assign a specific person to isolation, another to notification, and another to backup verification, and give each a target completion time.
The 3-2-1-1-0 rule extends the classic backup standard: three copies of your data, on two different media types, one copy offsite, one copy immutable or offline, and zero errors confirmed through regular test restores. We explain this in more detail in our post on hardening the 3-2-1 backup rule, including how to confirm a backup is actually immutable rather than just labeled that way.
- Assign an owner and time target to each step: isolation, notification, evidence capture, and restoration.
- Test backup restores regularly rather than assuming your last backup will work when you need it.
- Escalate to a managed provider or forensic team when in-house expertise or capacity runs short.
- Review our guide on building a cybersecurity incident response plan before an incident happens, not during one.
Pro Tip: Run a tabletop exercise of your incident response plan at least once a year so the people named on your checklist actually know what their role looks like under pressure.
Basic hardening steps like those outlined in this website security basics guide reduce the odds of the initial compromise that leads to ransomware in the first place.
Why Ransomware Recovery Means Rebuilding, Not Just Decrypting
Recovery isn't about getting a decryption key and moving on. It's environment reconstruction: proving every system you bring back online is clean, every credential has been rotated, and every persistence mechanism the attacker planted is gone. Restoring files into a still-compromised environment just resets the clock on the next attack.
The organizations that recover fastest are the ones that rehearsed their incident response plan before they needed it, with clear roles and a defined process for declaring the incident officially over. That discipline matters more than any single tool.
— Greg
How We Help After a Ransomware Attack
When ransomware hits, you need a partner who moves fast and knows your environment. We offer Managed Detection & Response to catch threats before they spread, along with backup and disaster recovery services built around immutable, tested restores rather than hope.
During an emergency engagement, we start with containment and evidence preservation, move into backup validation and clean rebuilds, and stay through post-recovery hardening.
- Managed Detection & Response for ongoing threat monitoring and containment.
- Backup & Disaster Recovery built around regularly tested restores.
- Incident response support, from initial isolation through system rebuilds.
- Direct access to our team rather than a generic national help desk.
Reach out through our end-to-end IT solutions page to talk through your situation and get a response plan moving today.
FAQ
What are the steps after a ransomware attack?
Isolate affected systems immediately, preserve evidence like memory captures and logs, and notify your incident response team along with CISA or law enforcement. From there, rebuild on a clean network, restore only from immutable or offline backups, and reset credentials before reconnecting anything to production.
What are the 5 stages of a ransomware attack?
Most ransomware incidents move through initial access, lateral movement and privilege escalation, data exfiltration, deployment of the ransomware payload, and extortion through a ransom demand. Precursor malware like Emotet or Cobalt Strike often appears well before the actual encryption stage.
What is the 3-2-1-1 rule for ransomware?
The extended 3-2-1-1-0 backup rule calls for three copies of your data, on two different media types, with one copy stored offsite, one copy kept immutable or offline, and zero errors confirmed through regular test restores. We break this down further in our guide to the 3-2-1-1-0 backup rule.
How do you recover data from ransomware?
Recovery depends on restoring from backups that were untouched by the attack, typically immutable or offline copies, after you've rebuilt affected systems on a clean network. CISA's recovery guidance recommends verifying backup integrity and running test restores before reconnecting any system to production.