Stop propagation without compromising reconstruction.
Ransomware can combine encryption, data theft, identity compromise, and extortion. Indiscriminate shutdowns or hasty restores can eliminate evidence, leave active persistence or extend unavailability. The intervention is therefore guided by a shared strategy.
Initial actions
- activation of the war room and decision-making contacts;
- selective isolation of compromised segments, endpoints and accounts;
- backup protection and suspension of risky access;
- collection of logs, samples, ransom notes and indicators;
- search for lateral movements and systems that are still reachable;
- evaluation of possible signs of exfiltration.
Analysis and recovery
NESQ reconstructs, within the limits of available evidence, the initial vector, the identities used and the extent of the compromise. Recovery starts from a trusted environment, with rotated credentials, fixed initial vulnerabilities, and hardened monitoring. Priorities follow critical processes, not just the technical availability of copies.
Deliveries
- timeline and technical perimeter of the incident;
- indicators and rules useful for searching for further compromises;
- restart plan and system validation criteria;
- documentation of the actions carried out;
- post-incident plan on identity, segmentation, backup and detection.
Legal, insurance decisions and decisions relating to any communications with the hostile actor remain the responsibility of the client and the appointed professionals; NESQ provides the necessary technical elements.