Ransomware
Malware or an intrusion campaign that encrypts victims' data and, increasingly, steals it first to extort payment.
Modern ransomware is usually human-operated: initial access (phishing, exposed VPN or RDP, a purchased foothold), credential theft and lateral movement to domain admin, deletion of backups and shadow copies, data exfiltration, then mass encryption often pushed by GPO or remote execution. Double extortion adds the threat of leaking stolen data, so good backups alone no longer remove the leverage.
Response priorities: contain (isolate hosts, disable compromised accounts, cut attacker access), scope the intrusion and how they got in, preserve evidence, and only then restore, from backups verified to be clean, into an environment where the attacker's persistence and Kerberos access (krbtgt reset twice) have been removed.
Prevention focus: immutable or offline backups that are tested, phishing-resistant MFA on remote access, fast patching of edge devices, EDR coverage everywhere, and tiered administration. Paying is a business and legal decision, and sanctions rules may prohibit it.
Learn it properly
Also used in
- The triage loopAnalyst · Analyst essentialsFree
- Attacker movement: kill chain and ATT&CKAnalyst · Analyst essentialsFree
- Writing intelligence reportsAnalyst · Threat intelligence for analystsFree
- Incident response engineeringSecEng · Detection & Response EngineeringPro
- Design an EDR telemetry pipelineHLD · Design problems: Telemetry & detectionPro
- Design a data deletion serviceHLD · Design problems: data securityPro
- Windows and identity logsAnalyst · Investigation & threat huntingPro
- Malware triage for analystsAnalyst · Investigation & threat huntingPro