Ransomware recovery: how a company was back in operation within 48 hours

Note: this is an illustrative case that combines situations typical of the ransomware incidents we handle. For reasons of confidentiality, the details do not correspond to any specific client or to real dates. The aim is to show how we approach this kind of incident technically.

How quickly can a business be operating again after a ransomware attack? It depends above all on how quickly the attack is isolated and how well the backups survived. This case illustrates how a mid-sized company was operating again within 48 hours of an attack that encrypted its file server.

The scenario: a Friday night

On a Friday night, the file server of a mid-sized company began showing files with an unfamiliar extension and a ransom note in every folder. The IT team found the problem when they arrived on Saturday morning, with a good part of the server already encrypted.

The first hours: isolate before anything else

The first step was disconnecting the server from the network to stop any spread to other machines, without switching it off straight away. In parallel, the state of the backup was checked: fortunately, an external backup that had been disconnected from the network at the time of the attack had not been reached.

Identifying the variant

The ransom note and the encryption pattern were analysed to identify the ransomware variant. No public decryptor was available for that variant, so the recovery route ran through the uncompromised backup rather than through any consideration of paying the ransom.

Restoration and return to production

1. Complete isolation of the affected server and of any machine with access to the same network.
2. Verification of the integrity of the uncompromised external backup.
3. Rebuilding the server on clean hardware or infrastructure, rather than restoring directly onto the compromised machine.
4. Restoration of the data from the validated backup.
5. Hardening recommendations before reconnecting the server to the production network.

The technical lesson behind the case

What made it possible to be operating again within 48 hours was not the speed of decryption, because there was none. It was that an external backup existed, disconnected from the network, which the attack could not reach. That is the difference between depending on paying a ransom with no guarantees, and restoring from a copy that was never exposed.