Contact us

Ransomware Response

Part of Incident Response Services

Ransomware is often the last step of an intrusion, not the first. We help you contain it, find out how it started and understand what was taken, so recovery rests on facts.

Talk to an incident responder

What we help with

  • Containment. Cutting off threat actor access and stopping spread: credentials, remote access, backups and affected systems.
  • Root cause. How the threat actor got in, which accounts and systems they used, and how long they were present.
  • Data theft questions. Many ransomware incidents involve data taken before encryption. We analyze the evidence for staging and exfiltration and help you answer what may have left the environment.
  • Leak-site and threat actor monitoring. Where relevant, we review what a threat actor has published or claims to hold.
  • Recovery support. Validating that systems and credentials are clean before they return to service.
  • Reporting. A timeline and executive summary written for leadership, insurers and legal counsel.

First steps if you are hit

  1. Disconnect affected systems from the network. Do not power them off if you can avoid it.
  2. Do not wipe or rebuild machines before evidence has been captured.
  3. Do not sign in to affected systems with high-privilege accounts.
  4. Preserve logs and any ransom note.
  5. Call us.

What you receive

  • Incident timeline and scope assessment
  • A statement of what the evidence does and does not show
  • Containment and eviction verification
  • Executive report and technical appendix
  • Prioritized hardening recommendations, including layered protection through CMDR

Prepare in advance

Tested backups that cannot be altered from the domain, logging that is on and retained, and a short written plan for who decides what all shorten ransomware incidents. We can review these with you, and offer incident response retainers.

Our team has delivered hundreds of assessments, has worked with large enterprises including Fortune 50 organizations, and has experience with HIPAA, FISMA and ISO frameworks and with nation-state and APT-level threat actors.

Talk to an incident responder

Book a free 30-minute incident response call, or call our 24/7 staffed hotline at 231-350-3171. Prefer to write? Email info@core-infosec.com or use the contact form. We reply to form and email enquiries by the next business day.

Book a free 30-minute IR call