Modern ransomware can only be decrypted by the attackers themselves, so the important question is what was left intact by this event. Those things include shadow copy backups (if the malware did not successfully remove them), unencrypted originals that remain in free disk space, files that the malware has not accessed, and backup systems that the malware cannot access. We will determine, for free, exactly what you are able to restore before you decide anything related to payment.
Remove all network connections to all affected computers, and between them. Do not wipe/reimage these computers yet, as their disks hold both the evidence and a good deal of the information that is recoverable.
Payment funds the attackers' operation. However, payment does not provide a guarantee that you will receive a working decryptor. In many cases, payment results in receiving a decryptor that either partially works or does not work at all. Determine first if you can restore some or all of what is lost without using any form of payment.
If personal data has been impacted, under UK GDPR you must notify the Information Commissioner's Office (ICO) within 72 hours of learning of the breach. This timer started at the time you became aware of the attack, not when you finish recovering from the incident.
Modern versions of ransomware target backups specifically. However, offline/immutable/cloud-versioned backup systems often survive such attacks. Consider checking your backups prior to accepting you do not have anything available for restoration.
Worth mentioning explicitly, since the competing narrative is widespread and costs money.
Modern ransomware is based on standard public-key encryption: usually AES for file encryption, and AES keys are themselves encrypted via RSA. The private key is never transmitted. There is no vulnerability to attack and no way to shorten the amount of time it takes to work out the private key.
There are several companies advertising ransomware decryption services. In practice, a number of them will be negotiating and paying the ransom on your behalf and charging you a higher fee than the original ransom demanded, without telling you that is what happened; you will be paying a premium for something you could have done directly, and funding the operation in the process.
The one legitimate exception is if you have an older version of ransomware or a poorly written version for which researchers have published a working decryptor. A good source to check is the “No More Ransom” website, which lists known versions of ransomware that can be decrypted. If your strain is not listed, then no lab will be able to decrypt your data.
Modern ransomware is racing to stay ahead of detection, and in doing so it leaves a great deal behind. Encryption runs are frequently interrupted before completion. Even though many strains target shadow copies, they don't always succeed in deleting all of them. Many strains will only encrypt the beginning of larger files to speed up the process, while still allowing users access to the rest of the file.
More practically speaking, the original data will often still be there on disk somewhere. When a ransomware attack writes encrypted copies of the original files and then deletes the originals, they have been deleted into “free space” just like any other file. And therefore, if you are using traditional mechanical media (as opposed to flash), those files can frequently be recovered from free space by carving them out of their prior locations on disk.
The work isn't actually decrypting the data. It's locating all the good stuff: the complete files, the files that were only partially encrypted, the volumes that weren't encrypted, and the machines that hadn't yet been hit when someone shut off the ransomware. On a typical incident, that's going to give you a substantial proportion of what matters.
Do not reimage the affected machines. Your first thought is likely going to be to destroy whatever was on those infected systems and rebuild, so you can get back to business. However, you need to realise that those disks contain the unencrypted original data in “free space”, which will be permanently destroyed once you reimage them. So take images of those disks first, then reimage later.
Ransomware recovery costs start at £500 +VAT and are priced on an individual basis after we've completed our free assessment, because of how much variability exists depending upon whether we're talking about one system or many.
We do not deal with attackers, we do not serve as an intermediary for negotiations and we don't help facilitate payments. If you wish to pay the attacker directly, then that's your call: it'll be done without us.
It's up to you to decide, and we will not make that decision for you; however, we are going to tell you first how much you may be able to recover without paying the ransom. There are no guarantees of recovery by making payment (the money is used to fund the attackers' operation), and the decryption tools provided will frequently only work part way, if they work at all.
No. Not for any current strain. No one can currently. Everything that the encryption run failed to find (shadow copies, original unencrypted data in free space, partially encrypted files, and untouched volumes) is what we can recover. And that is often quite a lot.
This is common, because contemporary malware strains were specifically designed to target backups. Before you assume the worst, check for copies that have been stored offline, immutable cloud snapshots and version histories. These are more likely to survive than your networked shared drives.
In cases where personal data is involved, under UK GDPR there is an obligation to notify the ICO within seventy-two (72) hours upon being made aware of the breach. This is a legal requirement regardless of whether the breached data is recovered, and the time period for this has already begun.
Yes. A formal technical report detailing what was discovered, what was affected, and what was recovered is included as standard on these jobs, in a format which is acceptable to both insurance companies and regulatory bodies.
For estates, ten to twenty working days. For individual machines, it takes less time. Each drive which has been impacted by a malware infection must be imaged prior to analysis, and on larger-scale incidents the primary focus of our activities will be on completing the imaging required for each machine.
So we name the family, put the numbers in writing, and then gather data from workstations, network-attached storage devices and servers alike, with the evidence safely preserved for your insurance company. Contact us today.