How do you know it's ransomware and not a technical fault?
Ransomware usually announces itself: a ransom note appears and files stop opening. But sometimes the first thing you see is a file server going down or an EDR that has stopped reporting. These signs, together or on their own, justify treating it as an attack:
- Files with a new, unknown extension that can no longer be opened.
- Text or HTML files with payment instructions in many folders, or a changed desktop wallpaper.
- Windows shadow copies deleted, and backup consoles with jobs removed.
- Antivirus or EDR disabled on several devices at the same time.
- New administrator accounts or password changes that nobody requested.
Many groups use double extortion: before encrypting, they copy data and threaten to publish it. The Verizon 2026 Data Breach Investigations Report puts ransomware in 48% of the breaches it analyzes. Assume from the start that there may be encryption and data theft at the same time.
What should you do in the first hour of a ransomware attack?
- Isolate the affected devices. Unplug the network cable and disconnect Wi-Fi and VPN, or use your EDR's network isolation. If several servers or subnets are affected, cut them off at the switch level. In the cloud, take snapshots of the volumes before touching anything.
- Don't shut them down unless you can't isolate them any other way. CISA's #StopRansomware Guide reserves shutting down for that case, because volatile memory is lost: processes, active connections and traces that are useful for the investigation.
- Coordinate over an out-of-band channel. Use the phone or an agreed messaging app that doesn't depend on your systems. The attacker may be reading corporate email and chat.
- Appoint one person to coordinate, and start a log with the time of every observation and every action.
- Shut down exposed remote access: VPN, remote desktops published to the internet and remote control tools you don't recognize.
- Protect your backups. Disconnect the repositories, pause cloud sync and change the backup console credentials from a clean device.
- Notify your cyber insurer if you have one (some policies require immediate notice or working with specific providers), your legal counsel and an incident response team.
What shouldn't you do if your files have been encrypted?
- Pay or negotiate on your own. INCIBE, Spain's national cybersecurity institute, advises not to consider paying the ransom as an option. Paying doesn't guarantee you'll get the data back, can lead to further extortion and doesn't ensure they will delete what they stole.
- Format or reinstall before investigating. You destroy the clues about how they got in, and you won't know whether a backdoor remains.
- Restore backups onto a network that is still compromised. The attacker can encrypt them again within hours.
- Sign in with domain admin accounts on devices that might be compromised. You'd be handing those credentials to the attacker.
- Delete the ransom note or the encrypted files. They help identify the variant and decrypt your files if a tool becomes available later.
- Share details publicly before you know the real scope.
How do you find out how they got in and what they took?
Encryption is the last stage. Before that, the attacker gained access, escalated privileges, moved between servers, copied data and disabled defenses. Reconstructing that timeline tells you what to close and from what date you can trust a backup. CISA recommends looking for new or elevated-privilege accounts, unusual VPN sign-ins, use of vssadmin, bcdedit or wmic to disable recovery, Cobalt Strike, unexpected remote access software, credential dumping and exfiltration tools such as Rclone.
| Stage | What to look for | Where to look |
|---|---|---|
| Initial access | Exploitation of the VPN or firewall, valid credentials used from unusual IP addresses, phishing | Firewall, VPN, identity, email |
| Persistence | New services, scheduled tasks or accounts; remote access software | EDR, Windows event logs, directory |
| Lateral movement | RDP, SMB or PsExec between servers; privileged accounts used in unusual ways | EDR, authentication logs |
| Exfiltration | Spikes in outbound traffic, uploads to cloud storage, Rclone | Firewall, proxy, DNS |
| Impact | Deleted backups, disabled EDR, mass encryption | EDR, backup console |
Stolen credentials are a common way in. In the Verizon 2025 DBIR, 54% of a sample of victims posted by ransomware groups had their domain appear in infostealer logs or in credential marketplace listings. Check whether yours were circulating before the attack.
Can you recover the files without paying the ransom?
Often, yes. There are three routes, and it is best to check them in this order:
- Offline or immutable backups that you have verified. This is the most reliable route.
- Public decryption tools. The No More Ransom portal, backed by the Dutch police, Europol and security companies, helps you identify the variant and check whether a decryptor exists. If there isn't one today, keep the encrypted files: one may be released later.
- Shadow copies or previous versions the attacker failed to delete. This is uncommon, but worth checking before you rebuild.
In what order do you restore operations after ransomware?
- Eradicate: remove the persistence you found and close the entry point (patch it, disable the account, remove the remote access).
- Reset credentials once the environment is clean: privileged accounts, service accounts and, in Active Directory, the krbtgt account, twice and in a controlled way.
- Rebuild critical services first from clean images, following a priority list agreed with the business.
- Restore verified data in order of priority.
- Reconnect in phases with heightened monitoring: EDR on every device and alerts on the accounts and indicators from the incident.
- Document the lessons learned and fix whatever allowed the attack.
Where can you get help in Spain if you're hit by ransomware?
- INCIBE's 017 helpline: free and confidential, from 8:00 a.m. to 11:00 p.m. (Spanish time) every day. Also available on WhatsApp (900 116 117) and Telegram (@INCIBE017).
- A police report to the Policía Nacional or the Guardia Civil. Your insurer and your bank may ask for it, and law enforcement may have information about the variant.
- Your legal counsel, especially if customer or employee data was stolen. Check with them about any obligations that may apply to you.
- A professional incident response team to contain, investigate and lead the recovery.
How Ciberia helps with ransomware
Ciberia MDR monitors the telemetry you already have 24/7 (endpoint, network, email, identity and cloud) and does not replace your EDR or SIEM. The contractual SLA is 15 minutes from a critical alert to initial containment. Alerts follow the same flow: context, decision (the AI proposes and an analyst validates actions with impact) and orchestrated response on your tools. Every automatic action is logged: who, when, on what criteria and on what data.
With Threat Hunting, Ciberia searches retrospectively for persistence and lateral movement based on MITRE ATT&CK hypotheses, and turns every finding into a new detection rule. Ciberia Intel adds context on the ransomware family, its techniques and its IOCs. If you are dealing with an incident right now, contact us from the incident response page or at [email protected].
