Every file had been renamed and there was a ransom demand in each folder; along with this, the data stored on the backup NAS (Network Attached Storage) was also encrypted using the same method because the backup NAS had been mapped as a drive letter. The machine continued to operate for two days while the company made a decision as to what they would like to do regarding the situation.
← All case files · £300 + VAT, flat
This is a scenario, not a case study. It illustrates a common failure type that we address on a regular basis, and how it is approached, written from the technical side (versus as part of a single customer project). Please visit our documented case files here.
A ransomware encryption process has been executed across a network. The files are given a new extension, there is a ransom note, and the backups were found to be encrypted as well, or to have simply failed silently over several months. The next step is determining which files may be recoverable without paying the ransom.
The use of public-key cryptography, a widely used form of encryption, is standard among modern forms of ransomware. The symmetric key(s) being used to encrypt the files are encrypted with the operator’s public key. This means that the operator’s private key remains on their end, thus eliminating any vulnerabilities to attack, and any possible shortcuts in computations.
There are several companies that advertise ransomware decryption services. In reality, however, a number of these services act as middlemen negotiating with and ultimately paying off the hackers on behalf of their clients, adding mark-up in doing so, and fail to disclose this fact. Therefore you will end up paying a premium for something you could have negotiated directly yourself; additionally your payment will fund the hackers one way or another.
The one honest exception to this rule is older or poorly constructed ransomware for which researchers have published working decryptors. The No More Ransom project lists these examples and you should check to see if your strain of malware is included. If it isn't, then no lab will be able to decrypt your data.
No, and for current families no one else can either. Today's ransomware uses standard encryption algorithms that are solid, and the keys used reside on the attackers' systems. The only free decryptors currently available exist specifically for older strains of ransomware where keys were captured or a flaw existed in the implementation.
The files that the run never reached; original content still in free (unallocated) space, where the application created an encrypted version in a new file and deleted the original; shadow copies whose deletion is itself recoverable; and any other items on systems which it could not authenticate to.
No. Pull it off the network and shut it down. There’s constant writing happening on a running Windows box. Those writes overwrite the deleted original (and most recoverable) files. A forensically created image of a powered-down box contains the evidence regardless.
Because it was accessible via the compromised box. The ransomware targets drive letters and network shares specifically. A backup means at least one copy exists which the compromised system can’t write to using its own credentials.
Whether to pay the ransom is up to you and does not impact our fees. We do state, however, that paying doesn't mean you'll get back a working decryptor, and it is worthwhile to exhaust the avenues listed above to attempt recovery prior to paying. The cost will be lower, and there won’t be any counterparty risks involved.
You have 72 hours if you believe that access to, or loss of, personal information may have occurred: you should assess any potential breach and possibly inform the ICO. Taking images of the compromised boxes before restoring anything preserves the items needed to respond to this assessment, without additional costs.
Disconnect the impacted systems from each other and the network. Don't re-image these computers, as they contain the unencrypted original files that are still in free space on their disks.
No payment will ensure success and many times the decryptors supplied will only be successful to some extent. See how much can be recovered without paying before making a decision.
There is an obligation under UK GDPR to give notification if your organisation has suffered a breach which affects personally identifiable information or data protected as “personal” under UK GDPR; this obligation is triggered when you become aware of the breach, and you have 72 hours to comply with this obligation. The timing of compliance does not depend upon the progress of the recovery efforts.
Offline backups, immutable snapshots for cloud storage, and version history tend to remain intact far more frequently than the contents of shared drives.