Eradication and recovery

If a ransomware attack was successful in an organization, it is important to have a plan at hand to bring the organization back up and running as quickly as possible. Additionally, as we have seen, these attacks are highly sophisticated and involve complex malware that can embed itself deep into the operating system. This makes ensuring that the threat has been entirely removed from the network difficult. As a result, there are specific ways to contain, eradicate, and recover from a ransomware incident that can ensure the best possible outcome.

Containment

Containing a ransomware incident involves two major actions. The first is to remove the capability of the adversary to exercise C2 over compromised systems. Adversaries often use a combination of commercial and open source tools such as Cobalt Strike or Metasploit, which use a variety of connection types. The goal of the initial investigation involves examining systems to identify the nature of the...