A guide to safely dealing with ransomware attacks

Dealing with a ransomware attack can be a stressful and challenging situation for any organization. It is crucial to remain calm and focused to make informed decisions that protect the organization’s best interests.

The first steps to take in case of a ransomware infection

Upon discovering an infected device, it is crucial to immediately disconnect it from the network to prevent the virus from spreading any further.
Once the device has been isolated, assess the extent of the damage and determine which data has been impacted. This will give you an understanding of what needs to be recovered first and how much it may cost.
Identifying the specific type of ransomware that has infiltrated your devices is a crucial step in understanding how it operates and developing an effective plan to remove it. You can use antivirus software, security professionals, or online resources to identify the strain of ransomware.
It is essential to communicate with all employees and inform them about the attack and the steps being taken to mitigate it. Emphasize the importance of avoiding clicking on suspicious links or attachments, as this can further spread the virus and compromise the security of the network.
In addition to removing the ransomware and restoring your data, consider reporting the attack to relevant authorities and organizations. This can help increase awareness and prevent future attacks, as well as meet any legal reporting requirements in your region. Additionally, reporting the attack can help other organizations learn from your experience and better prepare themselves for similar threats.

Methods to swiftly get money from victims

Cybercriminals employ several tactics to quickly obtain funds from their victims. They don’t just limit themselves to data encryption. They also utilize post-attack blackmail methods to force victims into paying. In many cases, perpetrators employ multiple extortion methods at the same time. These can include:

Publicize – cybercriminals may steal and publish data if money is not paid.
Destroy keys if a third-party negotiator is involved.
DDoS – hackers may promise to inundate your website with an excessive amount of traffic to intimidate you to pay faster.
Control printers – some cyber cooks have been known to seize control of the printers and produce ransom demands in plain sight of colleagues and patrons.
Use Facebook ads for malicious purposes.
Intimidate victims’ customers and partners by threatening to leak their data.

Where to look for help

It’s not recommended to handle the situation alone. Seeking professional assistance from organizations and resources, such as cybersecurity experts, local computer emergency response teams, ransomware recovery services, and law enforcement, can provide specialized expertise and guidance.

Before starting to negotiate

It’s important to consider all the risks and consequences of paying the ransom. Negotiating with ransomware attackers or paying the ransom is not advisable. This is because it may encourage them to carry out further attacks, thereby supporting their criminal activities and exposing your company to the risk of being attacked again. Furthermore, there is no assurance that the perpetrators will pass the decryption tool even if payment of the ransom is made.

Ransomware incidents and the transactions involved are frequently conducted in a secretive manner, utilizing encrypted means of communication and digital currency. It is advisable to try and negotiate for additional communication channels and methods that can be used for mutual trust, even though this might be difficult to achieve in this situation.

Should you choose to engage in negotiations and make a ransom payment, it is vital to maintain documentation of all correspondences, including instructions for payment. This can prove beneficial for authorities and cybersecurity specialists during investigations.

Request the perpetrators to prove they have the working decryption key by exhibiting its efficacy through the decryption of a few selected files. This practice can assist you in confirming that you are in direct contact with the perpetrators and not an intermediary. Additionally, researching the attackers and their past behavior may boost your trust in the negotiation process and provide you with an advantage in bargaining a reduced sum.

How to lower the ransom amount

If, after evaluating all alternative solutions, paying the ransom is the sole method for retrieving your information, these are some recommendations for negotiating with the perpetrators:

Do not let the attacker’s threats to destroy or leak data influence your decision. Remain calm and composed at all times.
Keep your cyber insurance status confidential.
Avoid proposing to pay the full ransom immediately. Consider making a partial payment initially, with the balance to be paid after the decryption key has been delivered and the data has been successfully restored.
Offer to pay the ransom using a digital currency that is less frequently employed and harder to trace, which could increase the perpetrators’ willingness to haggle over a reduced sum.
Think about making the attack and ransom negotiation public to apply pressure on the perpetrators, making it harder for them to exploit other targets and potentially making them more receptive to negotiating a lower ransom fee with you.
If the ransom amount has already been agreed upon and the attackers have agreed to lower it, you may attempt to negotiate for an even further reduction. It is crucial to bear in mind that the perpetrators likely have a set minimum ransom amount that they are willing to accept, and it may not be possible to bargain for a lower figure.

It’s equally important to be ready to terminate the negotiation if the attackers are unwilling to make concessions or if their conditions are unsatisfactory, even if it results in the loss of your data.

Staying safe in the future

In order to prevent future ransomware attacks, it is vital to prioritize preventative measures. Establishing a comprehensive cybersecurity strategy that encompasses routine software updates and the implementation of security software to protect your organization is imperative. Your employees should be well-educated on the dangers of ransomware and how to protect themselves by avoiding suspicious email attachments and links. Regular backups and a disaster recovery plan will help ensure that important data can be restored. It is crucial to use strong passwords and employ multi-factor authentication (MFA) whenever possible. Lastly, purchasing cybersecurity insurance can provide financial protection in the event of any security incident and is something to consider for your organization.