Ransomware: the first hour of your response

The first hour after ransomware is recognised decides whether you recover from backups or negotiate from weakness. Panic encrypts twice: once on disk, again in the decisions you skip. This is a practical first-hour checklist for the moment someone says “the shares are gone” or “the login screen is a ransom note”.

Minute zero: name it and stop the spread

Declare an incident. One incident commander, one comms owner, one technical lead. Everyone else supports those three. Do not debate taxonomy in the first hour — ransomware, wiper or “severe malware” can wait for forensics. What cannot wait is containment.

Isolate affected hosts and file shares from the network. Prefer pulling the network cable or disabling the switch port over a graceful shutdown if encryption is active: volatile memory still holds keys and beacons.
Disable remote access paths the actor may hold — VPN profiles, SSO sessions, privileged jump hosts, exposed RDP/SSH. Reset those credentials from a clean admin workstation, not from a suspect machine.
Pause non-essential outbound traffic from the impacted VLAN if you can do it without killing the monitoring you still trust.
Do not power-cycle everything blindly. You may destroy ransomware keys in memory and evidence of the entry point.

NCSC’s ransomware guidance (opens in a new tab) and CISA’s StopRansomware (opens in a new tab) resources both put containment and evidence preservation ahead of “rebuild everything now”. Follow that order.

Preserve evidence while you still can

Photograph ransom notes and login banners; note exact times in UTC and local time.
Collect volatile data from a sample of impacted hosts if your IR retainer or internal team is ready: memory, running processes, network connections.
Export EDR detections, VPN logs, identity logs (Entra ID / Okta / AD), email gateway and firewall denies for the last 72 hours.
Snapshot clean-looking domain controllers and critical servers read-only before anyone “helps” by tidying files.

If the intrusion may have started through a known exploited edge flaw, treat the hour like the forensic-triage path in BOD 26-04 and the KEV: preserve, then patch, then hunt. Recent healthcare disruption such as UNM Health shows how fast operational impact arrives; your first hour is clinical and technical at once.

Protect the crown jewels and the backups

Ask, out loud: are backups reachable from the same credentials the actor just used? If yes, freeze backup administration, rotate those vault credentials from a clean path, and verify immutability or offline copies before anyone starts mass restores. Restoring into a still-compromised domain re-encrypts your recovery.

Identify top business services: payments, care systems, safety, payroll, customer auth.
Fail over only where the failover estate is verified clean.
Keep a written list of what you took offline and why — regulators and insurers will ask.

Communications in the first hour

Internal: honest holding statement to staff — systems issues, report anomalies, do not pay anyone who cold-calls claiming to “help decrypt”.
Executive / legal / insurance: notify per your playbook. Insurers often require early contact before you hire outside counsel or negotiate.
Regulators and customers: the first hour is usually too early for a public root cause, but start the clocks. If personal data may be involved, UK GDPR expects you to assess risk to people’s rights and freedoms and, where notification to the ICO is required, to do it without undue delay and where feasible within 72 hours of becoming aware. Report the incident through the NCSC’s reporting routes early so you get handling advice. Sectoral duties (for example under the evolving UK cyber resilience / NIS framework) may add shorter operational clocks — know yours before hour two. Other regimes run their own clocks in parallel: EU GDPR Article 33 is also 72 hours for personal-data breaches; US listed companies face an SEC Form 8-K Item 1.05 duty to disclose a material cybersecurity incident within four business days of determining the incident is material; and CIRCIA sets statutory clocks of 72 hours for covered US critical-infrastructure incidents and 24 hours for ransom payments, which become mandatory once CISA’s implementing rule takes effect. EU product duties such as the CRA path in our CRA 24-hour reporting checklist are a separate track when you are a manufacturer in scope.
Do not negotiate or pay in the first hour. You lack scope, backup confidence and counsel. The NCSC and UK government do not condone ransomware payments. Paying later is a separate legal and commercial decision — and if the recipient is a designated person under UK financial sanctions, a payment can be an OFSI breach. Paying blind funds the next affiliate and can create sanctions exposure on top of the incident.

Hunt the entry point while containment holds

Parallel to isolation, start a narrow hunt for how they got in. Edge appliances, VPN gateways, webmail, service-desk tools and stolen credentials remain the usual doors. Check the last successful privileged logons, new local admins, freshly installed remote-access tools and unexpected cloud OAuth grants. If a current KEV matches kit you expose to the internet, assume that path until disproved — the same discipline we use on Alerts such as PHP2Shell and the cases tracked on the Alert Tracker.

Assign one person to timeline construction: first anomalous logon, first tool transfer, first encryption. A one-page timeline after sixty minutes is worth more than a perfect diagram after a day. It tells counsel, insurers and restorers where not to trust a host.

Money, decoys and bad advice

Expect affiliate contact attempts by email, Tox or a leak-site countdown. Do not reply from an infected mail tenant. Expect “helpers” on social media selling decryptors. Most are scams or recycled keys for other strains. If your insurer or counsel later authorises a negotiation channel, it will be deliberate, logged and separate from the first-hour chaos. Your job in hour one is to keep that option open by preserving evidence and not spraying Bitcoin into the void.

What “done” looks like at minute 60

By the end of the first hour you should have: an incident commander; a containment map of what is isolated; preserved evidence and logs; backup vaults protected; a credential reset plan for privileged and remote-access paths; and a timed agenda for hour two (identity sweep, EDR full-estate scan, restore decision tree). You will not have full eradication yet. That is normal.

Practise this as a tabletop before you need it. The teams that waste the first hour invent roles as they go. The teams that keep the business alive already wrote them down.

Sources

Follow Cyber-Threat.net RSS Feedly (opens in a new tab)X (opens in a new tab)Bluesky (opens in a new tab)LinkedIn (opens in a new tab)