Determining the Scope and Impact of a Ransomware Attack

Ransomware attacks are constantly changing, meaning they are getting more sophisticated and causing more damage to businesses. Because of this, noticing and reacting to an attack is not enough. You and your team also need to determine the scope of an attack and how it will impact your business to react effectively.

There are several ways that a cybercrime group might gain access to your files, and with this, there are many places they can hide within your system. So, you need to assess the extent of the attack to be able to make an informed decision about how to deal with it. Rushing into action without the full picture could make you vulnerable to another attack, data loss and increased downtime.

At Solace Cyber, we are ransomware recovery experts, offering rapid digital forensics and incident response to all industries and sectors that experience a malware attack. Our teams are highly experienced cybersecurity professionals with knowledge of all ransomware groups, including Akira, BlackCat and Lockbit3. We work by the rule of always getting a full understanding of the situation before creating an action plan.

Here, we explain why you need to determine the scope of the attack before jumping into action and how you can do it.

No matter how or where you notice the potential attack, the first thing you need to do is thoroughly investigate your system and networks to understand where the attack is happening and the existing damage.

Within this process, you will need to:

• Identify Compromised Endpoints: Workstations, servers, cloud storage and backup systems.
• Network Map: Determine how far the attack has spread across your network.
• Review Encryption Status: Assess whether critical data has been encrypted or stolen.
• Check For Persistence Mechanisms: Look for any backdoor or malware that might be hidden to be left behind for future exploitation.

Taking these steps allows you to get a good understanding of what data they might already have and where they are working so you can create an efficient and targeted response.

If you are hiring a cybersecurity company to help respond to the attack, completing this step means you can provide a comprehensive summary of the situation to the team on their arrival, speeding up the onboarding process.

With an understanding of the attack and external and internal teams informed of the breach, the next step is to turn to business operations to see how this is going to impact your business, specifically looking at which services are impacted the most.

When completing this step, look at:

• Operational Disruptions: Which departments or services are affected? Can critical business functions continue, or do you need to completely shut down?
• Data Integrity and Confidentiality Risks: Has sensitive data been encrypted, deleted or exfiltrated? Is there a GDPR or other data compliance risk?
• Financial and Reputational Consequences: Work out the cost of downtime, ransom demands and potential legal consequences and damage to the reputation of your brand.

While there might be steps dictated to you by compliance with data protection regulations, knowing how the attack is impacting your business is likely to guide you through how you respond to the attack.

The above steps all need to happen quickly, and if you are employing professional help, they will guide you through the steps at a rapid pace. This is because you need the knowledge from the steps to be able to put an action plan in place, and the faster this is done and the actions taken to respond, the better the chance of recovery and limit the consequences.

Formulating a plan will predominantly sit with the external Incident Response Team you hire to respond to the attack, but it is important you know these steps to be able to facilitate them in creating the plan.

• Containment Strategy: Write steps to prevent the attack from spreading further.
• Recovery Planning: Creating a plan to restore data, including backups and decryption possibilities.
• Evaluating Ransom Payment Risks: Paying ransoms will be avoided where possible, but it will be a considered action in light of other possibilities available.
• Post-Attack Security Enhancements: Strategies to strengthen security and defence to prevent further attacks will be put in place.

Of course, these steps and planning can’t happen if you don’t know what is going on. If you start planning with a partial understanding of the scope of the attack, you will likely miss part of the malware, allowing it to continue attacking the system.