Ransomware Incident Response: How to Run the First 72 Hours

Much of what goes wrong in ransomware incident response comes from cutting power and starting restores before anyone has scoped identity, backups, and data theft. The first decisions usually fall to whoever is on call: in Sophos's 2026 Active Adversary data, 88% of ransomware deployments happened outside business hours.

The generic incident response lifecycle still applies, and so does the scoping work of incident response triage. Ransomware adds pressures the lifecycle doesn't fully cover. By the time the ransom note appears, the attacker has often spent days inside and gone after your recovery paths. Data may already have left, and regulators, insurers, and the extortion group each run their own clock.

TL;DR:

• Coordinated containment beats fast containment: isolate at the network layer, talk out of band, and keep power-off as a fallback for active spread.
• Identity, hypervisors, and backups decide whether a restore holds, so securing them comes before the rebuild.
• Data theft can drive extortion without any encryption, so exfiltration scoping shapes the legal and payment decisions.
• Every reporting clock starts on its own trigger, and counsel and the insurer belong on the first call.

Hours Zero to Six: Contain Without Destroying the Evidence

Isolation that isn't coordinated tells the attacker you've seen them. CISA's #StopRansomware Guide, updated in 2023, warns that uncoordinated action can push actors to move laterally to keep their access, or to deploy ransomware widely before networks go offline. It recommends isolating systems in a coordinated way and using out-of-band channels such as phone calls. Take the network offline at the switch level when several systems or subnets look affected, and skip the host-by-host chase.

Coordination has to happen fast. In the fastest quarter of the intrusions behind Unit 42's 2026 incident response report, attackers reached exfiltration in 72 minutes, against a median of two days.

Isolate First and Power Off Only as a Fallback

CISA says to power devices down only if you can't disconnect them, because shutting down loses evidence held in volatile memory. Microsoft goes further and says to isolate compromised devices and leave them powered on.

Our position is that network isolation is the default. Power-off is justified when encryption is still spreading and the network can't be cut any other way. Before you rebuild anything, take a system image and memory capture from a sample of affected workstations and servers.

Assume the EDR Is a Target

In April 2023, Sophos X-Ops documented AuKill, a tool that abused an outdated Process Explorer driver to disable EDR processes before ransomware deployment.

Confirm early that tamper protection is on across the estate. Attackers switch tools when one EDR killer fails, so blocking a single vulnerable driver may not be enough, and ESET recommends monitoring for unusual kernel driver loads.

Identity and Hypervisors Decide Whether Recovery Holds

Google's M-Trends 2026 describes ransomware evolving into recovery denial, with operators going after backup infrastructure, identity services, and virtualization management planes. Containment that leaves those layers alone tends to fail on the restore.

Once an actor holds administrative control of Active Directory, Microsoft's Octo Tempest recovery guidance says to assume every identity and credential is compromised.

Recovery then needs a double krbtgt reset, and the sequence has to account for AD replication and Kerberos ticket lifetimes. CISA's eviction guidance says to let the first reset replicate before the second and to wait at least 10 hours, longer if ticket lifetimes were extended. Microsoft's ransomware response approach runs two scripted resets in rapid succession, optionally after shortening the krbtgt lifetime, with every domain controller you plan to keep already online.

The faster path invalidates forged tickets sooner but raises the risk of Kerberos authentication problems in AD-dependent applications. Whoever owns AD recovery should choose and validate the sequence.

Human error can undo the reset. In a 2022 analysis of the StellarParticle campaign, CrowdStrike found the actor returned quickly after a double krbtgt reset because administrators had reset their own passwords to the same values as before.

Cloud identity needs its own steps. In Entra ID, a password reset may not revoke every refresh token, depending on the reset method and token type, so revoke the user's sign-in sessions explicitly and verify the result. In Okta, "Clear User Sessions" revokes OAuth tokens, including OIDC refresh and access tokens, and forces the user to authenticate again.

Hypervisors let encryption scale: Unit 42 documented a BlackSuit operation that encrypted hundreds of VMs across roughly 60 ESXi hosts at once.

ESXi does not support MFA for AD users, and Mandiant recommends taking ESXi hosts off the AD domain and giving infrastructure admins a separate identity provider. CrowdStrike's ESXi guidance adds containment steps that often get missed. Keep running VMs powered on, because shutting down or rebooting them releases file locks that can stop ransomware from encrypting their disk files. Where the situation allows, unmount datastores holding VMDKs that aren't in use to protect files the ransomware hasn't reached yet.

Scope Data Theft Before You Argue About Encryption

Unit 42 found encryption in only 78% of extortion cases in 2025, down from near or above 90% in 2021 through 2024. In Coveware's Q3 2026 data, exfiltration was among the most common tactics, and leaked Silent Ransom Group communications showed actors who had largely dropped network-wide encryption for direct cloud and SaaS exfiltration. Sizing the incident by encrypted hosts misses that part of the attack.

Exfiltration tools leave artifacts. In its 2025 engagements, Google regularly saw Rclone and legitimate transfer clients such as FileZilla, WinSCP, and PuTTY Secure Copy in intrusions with confirmed or suspected data theft. Rclone command lines and config files, DNS queries to MEGA upload domains, and FileZilla's recentservers.xml, which records the servers a host connected to, are the first pivots.

Pull logs from suspected exfiltration hosts before retention rolls them over. NetFlow can estimate how much data left and when. Identifying what left usually takes correlation with file access, DLP, or endpoint telemetry.

Treat leak-site posts as claims until your own evidence corroborates them. Coveware reported as early as 2021 that some groups fabricated exfiltration that never happened. ISACA's position is the right default: "unauthorized access alone ... does not imply data were exfiltrated." That distinction carries legal weight once notification decisions start.

Backups and Recovery: Verify Before You Restore

In Veeam's 2025 survey, attackers targeted backup repositories in 89% of attacks. In a July 2025 Akira intrusion that the DFIR Report documented in June 2026, the actor pulled Veeam credentials from the backup server's PostgreSQL database despite already holding domain admin. Verify attackers didn't modify or delete backups before you build the recovery plan on them.

Choose restore points against the earliest evidence of compromise, because the encryption date alone won't tell you where a clean state ends, and validate backups in isolation before restoring them. Ransomware may also be evidence of an earlier unresolved compromise, and CISA says to find dropper malware such as QakBot or Bumblebee before rebuilding from backups.

Domain controllers carry their own risk, since restoring a DC image taken after initial compromise can bring the attacker's persistence back with it. Microsoft's forest recovery guidance restores one trusted writable DC per domain in isolation and redeploys the rest.

In Sophos's 2024 survey data, median recovery costs reached $3M when backups were compromised, against $375K when they weren't.

Extortion, Counsel, and Insurers Run on Their Own Track

Decisions in the first hours can strengthen or weaken privilege over the forensic work. In the 2020 Capital One ruling, outside counsel engaged Mandiant, but Mandiant worked under a pre-existing retainer and its fees were paid from the cybersecurity budget, and the court ordered the report produced.

Troutman notes that plaintiffs argue privilege is weaker where early forensic work was directed solely by IT or security. Bring in breach counsel before the forensic firm starts scoping and document the investigation's legal purpose. Even then, protection depends on the facts.

Check your policy's notice requirements and whether the carrier must approve vendors or a ransom payment before you commit to either. Vendor choice also affects how fast coverage lands. In a 2023 analysis, Marsh found the average time from event notification to coverage confirmation or first payment was just over two months with panel vendors and more than 12 months without them.

Before any payment with a US sanctions nexus, check whether the recipient is sanctioned. OFAC's September 2021 advisory explains that civil penalties can apply on a strict liability basis, even if the payer didn't know the payment was prohibited.

The payment rate for exfiltration-only attacks sat at 15% in Q2 2026, and Coveware argues that once a victim can restore operations, paying for a deletion promise nobody can verify becomes a legal and regulatory question, one most victims answer by declining. Whatever you decide, report the attack to the FBI or CISA.

Reporting Clocks Start on Different Triggers

A single 72-hour deadline gets most of the attention, but the real question is what starts each clock. The triggers vary by regime:

‍

Under NIS2's Article 23, adopted in 2022, the one-month final report runs from the 72-hour notification. If the incident is still ongoing then, file a progress report and the final report within one month of handling it.

DORA makes one exception to its 24-hour limit: an incident classified as major later than that is due within four hours of classification. Intermediate and final reports follow within 72 hours and one month. Australia's payment-reporting rule under the Cyber Security Act took effect on May 30, 2025, and its education-first implementation period ended on December 31, 2025. PCI DSS sets no day count of its own, but card brands do: Visa's current rules require reporting a suspected compromise of Visa account data within three calendar days.

The UK's ransomware payment ban and mandatory reporting regime remains a proposal as of October 2026. The EU's Digital Omnibus would narrow GDPR breach notification to high-risk breaches and lengthen the deadline; the Council agreed its position on October 21, 2026, and the change is not yet law.

Counsel should map these on day one. The EDPB allows a short initial investigation before awareness attaches, though it has to start promptly, and the SEC clock doesn't start until the materiality call.

Where MDR Response Ends and the IR Retainer Begins

MDR and IR retainers cover different ground, and the boundary often stays undefined until an incident forces it. MDR contracts set how far the provider can act on its own. Expel says it "automates the Remediation Action itself but not the decision to remediate." Sophos's MDR terms warn customers that "Notify Only can materially delay containment and disruption actions."

Retainer firms cover forensics, negotiation, and the legal-facing work, and choosing one mid-incident costs time you don't have. Daylight's security experts lead response within Daylight's MDR scope, and potentially disruptive actions such as disabling an account require the authority the customer has granted.

How to Decide in the First 72 Hours

The first calls in ransomware incident response can't wait for perfect information, which is why pre-authorized containment and a pre-agreed retainer matter more than any single tool:

• If ransomware is actively encrypting and switch-level isolation isn't possible, power off affected endpoints and servers, leave ESXi guests running, and record that you gave up volatile memory to stop the spread.
• If domain controllers show attacker activity, assume full identity compromise and schedule the two krbtgt resets with your AD recovery owner.
• If vCenter or ESXi management is compromised, restrict direct management access, keep VMs running, and unmount idle datastores where operations allow, then take hosts off AD through a planned change.
• If exfiltration evidence is ambiguous, have counsel record it in writing as unconfirmed and scope notification to data the attacker could reach as well as data forensics proves was copied.
• If clean backups exist and operations can be restored, treat any payment demand as a legal and sanctions decision, not a recovery decision.
• If your MDR provider isn't on your insurer's panel, settle the handoff and consent terms now.

Frequently Asked Questions About Ransomware Incident Response

Should Anyone on Our Team Contact the Threat Actor Directly?

No. Arete's 2021 guidance leaves negotiation and contact to the IR firm. CISA's PRC advisory describes temporarily reducing an attacker's privileges, in place of revoking them, when you need to avoid alerting them. North Carolina state agencies and local governments are barred by statute from paying or communicating with an attacker that encrypted their data for ransom.

Does Paying Remove Our Notification Obligations?

No. Coveware notes that paying rarely relieves regulatory or legal notification duties. In one Q2 2026 case, Coveware found that after a payment meant to guarantee deletion, a separate criminal group still held victim names and data samples.

Is Encryption-Only Ransomware a Reportable Breach?

Often, yes. Under HHS's 2016 ransomware guidance, which still applies, ePHI encrypted by ransomware counts as acquired, and a breach is presumed unless you can show a low probability of compromise. EDPB guidelines published in January 2022 treat ransomware as an availability breach that may still be notifiable. US state laws split: acquisition-based states may not treat encryption without evidence of download as notifiable, while access-based states set a lower bar. The answer turns on each state's current wording, a split Orrick laid out in 2016.

Can a Public Company Disclose Before Deciding Materiality?

Yes. In a May 2024 statement, SEC staff encouraged companies to use Item 8.01 for incidents not yet determined to be material.

Is the CIRCIA 24-Hour Ransom Payment Report in Force?

Not yet. CISA sent the final rule to OMB for review on October 1, 2026, and covered entities don't have to report under CIRCIA until the rule takes effect. Once it does, they will report covered incidents within 72 hours and ransom payments within 24 hours.