Take all of the impacted computers offline from both the LAN (network) and WAN (internet): take the cables out and disable Wi-Fi on them. Then fight against these two common impulses that destroy evidence when dealing with a ransomware infection: wiping and reinstalling. Don't touch anything on the NAS or server, leave it exactly like you found it until there's a plan for what to do next. Document the ransom note by taking pictures, document the file extension the encrypted files are ending with currently, and immediately pause every scheduled backup job, because running a backup job now may overwrite your last clean copies with encrypted ones.
There is one more call you will need to make early on. If there is personal information on the systems that were affected and your organisation has to comply with UK GDPR, you may also be required to report the incident as a "breach": please consider bringing in someone who can assist with compliance issues (your compliance person or provider) when you initially address this issue, at the start rather than the end, so they can provide input during the process.
First: copies the malware never reached. Backups offline and off site, version histories within OneDrive, SharePoint, Google Drive and Dropbox (all of which have the capability to retrieve files from versions prior to the attack), snapshots on NAS devices, and shadow copies of Windows. Current strains will try to delete or destroy all snapshots and shadow copies, but try is the key word: partial survivals are something we find again and again.
Secondly: a publicly available decryption tool. There are several ransomware families that researchers and the No More Ransom project have been able to break, and which have publicly available decryption tools for free. If you can identify the strain precisely by the ransom note in addition to the new file extension used (which together usually does it), then you will be able to determine if there is a publicly available decryption tool for your particular strain. Never pay for 'decryption services' from an unknown website. In most cases, these companies just pay the criminals with your money, or they simply keep it.
Third: whatever the encryption never finished. It takes hours to encrypt terabytes, and attacks do get interrupted, by staff, a reboot or even the malware's own errors. A real job will turn up clean files that are found on secondary volumes, prior versions of files in unallocated space, complete virtual machine snapshots, database backup files that the malware did not parse, and files which were only touched in the first few blocks. These can all be recovered with conventional lab techniques applied to an unconventional crime scene: create an image of each drive, and then review, file by file, what survived.
We have a very straightforward answer: no, and we never (as a matter of policy) pay ransom demands nor do we act as intermediaries in negotiations with the attackers on behalf of our clients. The practical case against paying is as strong as the ethical one: there are consistently a significant percentage of people who end up paying for nothing (i.e. receiving nothing usable), you will advertise your organisation as a willing payer to the next cybercrime gang, and as per the official UK guidance, you should not pay; additionally, if the group behind the ransomware is sanctioned then making the payment may itself carry legal risk. Use the three options outlined above instead: companies that enter into these situations thinking they have 'no other option' usually leave with far more recovered than they expected.
Please file an incident report via Action Fraud and preserve the encrypted drives. Preserving these items costs nothing, and ransomware families do get broken months after a given incident occurs. At that point a shelf of preserved drives that were previously worthless can suddenly become recoverable overnight.
Get an initial quote prior to sending in your hard drive(s). Send in all disks from a NAS or server. Each disk should be clearly labelled with its corresponding bay. The NAS device will only need to be sent in if you are unable to remove its disks. Post them to us tracked and insured, or they can also be dropped off directly at our lab in Bristol, Monday to Friday, 9am to 5:30pm, with no appointment needed. Once we receive them, we begin the imaging process before any analysis, therefore your originals will never be worked on. Upon completion of the imaging process, we create a written account detailing what is recoverable for you through all three possible methods of recovery, as well as provide one fixed quote for the service. Ransomware attacks fall under our forensic category. Therefore, once a fixed quote has been agreed upon, payment is required upfront rather than on completion. A live incident (i.e. when your PC or server is currently being compromised) is pulled to the front the moment it's booked in, so call us on 0800 689 0668 and say the attack is still running.
Full details are listed on the data recovery from ransomware attacks page. There is also additional reading in recovering data from NAS systems, recovering RAID systems, and data recovery for SAN & virtual machines. Between them, these cover the storage systems where business data typically resides when a ransomware attack lands.
Stop all backup jobs when ransomware is detected on your system. One more scheduled backup run post-encryption may overwrite your only clean backups with encrypted ones. This type of automation error is the most costly there is.
We offer a free diagnostic on arrival and one fixed quote; ransomware recovery is forensic work, so it is paid upfront once you accept that quote. Please begin online or call us using our freephone number.