Disconnect the impacted computers from the internet and other networks (remove physical network cables and shut down Wi-Fi), but do not wipe any systems and do not power off the NAS or servers until you have determined how best to proceed. Reinstalling Windows and attempting to move on will destroy the very artefacts that allow you to recover from this event. Take a picture of the ransom note, record the file type (extension) that your encrypted files now have, and stop running your backup software immediately, so your last good backups are not overwritten with the new encrypted versions.
As an added complication, if the company you represent falls within the scope of UK GDPR and personal data is involved, you should also be aware that a ransomware attack could potentially trigger a reporting obligation. Therefore, consider involving those who manage your compliance activities from the outset.
Route one: copies the ransomware missed. Offline and off-site backups, cloud version history (OneDrive, SharePoint, Google Drive and Dropbox can roll files back to pre-attack versions), NAS snapshots and Windows shadow copies. Most modern ransomware strains try to delete shadow copies and NAS snapshots, but they only succeed sometimes, and we regularly find both partly intact.
Route two: a free decryptor. Researchers and the No More Ransom initiative have published free decryption tools for certain ransomware families that have been broken. Once you identify which ransomware family your system has been attacked by (based on the ransom note and the file extension your encrypted files now carry), you will know whether a free decryptor exists for that particular family. Do not purchase a 'decryption service' from an unknown website, as most such services merely pay the attackers or simply take your money.
Route three: lab recovery of what encryption didn't reach. Because encryption operations take time, attacks often get interrupted. On real jobs we find that secondary drives contain untouched files, older versions of files exist in unallocated space, whole virtual machine snapshots remain intact, database backups were not parsed by the malware, and partially encrypted files have only their first blocks damaged. This is common data recovery practice applied to an unusual crime scene: drives are imaged, forensic tools are used, and the files are audited one by one to determine what survived.
Payment is a last resort, and not merely because it is unethical. Industry surveys year after year show that a significant number of people who pay their ransoms do not obtain any usable data as a result. Paying also marks your organisation as one that pays, increasing the likelihood that the next crew will target you. UK authorities advise against making payments, and for some sanctioned groups making a payment can itself create legal exposure. Exhaust all three routes above before considering a payment: most organisations that contact us believing they will need to pay end up discovering they have much more surviving data than they initially believed.
The next step would be to report the ransomware attack via Action Fraud and to keep preserving all available evidence. There is no cost to submitting a report, and occasionally the strain you were hit with is one that gets broken months later, at which point preserved encrypted drives may become recoverable.
Obtain a quote by telephone on 0800 689 0668 or use our free online diagnostic first. Then send in the affected drives, taken out and each labelled by its bay (for a NAS, take the disks out if you can; if they won't come out, send the NAS), and we will image everything before any analysis, so the originals are never worked on. Your report will cover what may be recovered across all three routes, along with one fixed quote in writing. Ransomware is classed as forensic work, so it is paid upfront once you accept the fixed quote. Business-critical cases are prioritised on arrival: call 0800 689 0668 and say it is an active incident.
The complete description of our service is provided on our ransomware data recovery page. Additional related reading includes NAS recovery, RAID recovery and SAN & virtual machine recovery, the locations where most business data resides when ransomware strikes.
Stop backup jobs immediately after an attack. Backups that run automatically after an attack can write over your clean backups with newly encrypted versions, turning a terrible day into an utter disaster.
You will receive a free, no-obligation diagnostic and a single fixed price quote. For ransomware recovery the price is taken upfront once you have accepted the quote. Get started now or ring our freephone.