First Hour of a Ransomware Attack: A Practical Guide

Definition#

The first hour of a ransomware attack is the initial containment and coordination period after suspected encryption, extortion, or unauthorized access is detected. The objective is to stop the attacker’s momentum, preserve evidence, protect recovery options, and establish one controlled response process.

How It Works#

Ransomware incidents often unfold in stages rather than as a single encryption event. An attacker may first obtain credentials, move laterally, disable security tools, access backups, steal data, and then encrypt systems. By the time a ransom note appears, the attacker may already control multiple endpoints, servers, cloud resources, or administrator accounts.

Your first-hour response should therefore focus on containment and decision quality, not on immediately deleting malware or rebuilding machines.

1. Confirm the Incident and Establish an Incident Lead

Treat multiple encrypted systems, ransom notes, unusual administrator activity, or mass file renames as a potential major incident. Designate one incident commander or accountable leader. That person should coordinate technical responders, business owners, legal counsel, communications, and external support.

Record the time of detection, affected systems, observed symptoms, and actions already taken. Avoid allowing multiple teams to make uncoordinated changes.

2. Isolate Affected Systems

Use network access controls, endpoint isolation, switch ports, firewall rules, or wireless controls to separate known-affected systems from the network. Prioritize systems showing active encryption, command execution, or suspicious remote administration.

Do not broadly disconnect everything without considering business and evidence impacts. Preserve volatile information where practical, and do not shut down systems unless encryption is actively progressing and qualified responders determine that shutdown is necessary.

If a workstation is displaying a ransom note, disconnect its network connections. Do not browse shared drives, open suspicious files, or use the affected device for investigation.

3. Protect Identity and Administrative Infrastructure

Assume that privileged credentials may be compromised. From a known-clean device, review and restrict privileged accounts, disable suspicious accounts, revoke active sessions, and rotate high-risk credentials according to your response plan.

Pay particular attention to:

• Domain, directory, and cloud administrator accounts
• Remote access and virtual private network accounts
• Backup administrator credentials
• Service accounts with broad permissions
• Single sign-on, email, and multifactor authentication systems

Do not reset every password blindly if doing so could destroy evidence or lock out responders. Coordinate identity changes with the incident lead and forensic specialists.

4. Protect Backups and Recovery Systems

Ransomware operators commonly target backups because they remove the victim’s easiest recovery path. Restrict access to backup consoles, disconnect offline or removable backup media, and verify whether recent backups are intact.

Do not start a large-scale restore until the environment is understood and attacker access is contained. Restoring into a compromised network can lead to reinfection.

5. Preserve Evidence

Preserve ransom notes, suspicious emails, endpoint alerts, authentication logs, firewall records, cloud audit logs, and relevant system images. Capture screenshots and record file paths, hostnames, usernames, timestamps, and hashes where available.

Avoid running cleanup tools, deleting accounts, reimaging devices, or modifying logs before evidence has been collected. If you lack internal forensic capability, contact your incident response provider, cyber insurer, or legal counsel immediately.

Use approved endpoint security tools that are already part of your response plan. For example, organizations with an existing Malwarebytes deployment should coordinate scans and remediation with the incident lead rather than launching uncontrolled cleanup activity.

6. Use Trusted Communications

Assume that corporate email, chat, and shared documentation may be monitored or compromised. Establish an out-of-band communication method, such as phone calls or a prearranged emergency channel, and verify contacts independently.

Notify only the people who need to act. Internal messages should state what is known, what is being done, and where verified updates will appear. Avoid speculation about the attacker, the amount of stolen data, or regulatory impact.

7. Escalate Early

Contact legal counsel, cyber insurance, incident response specialists, and relevant law enforcement or regulatory contacts based on your jurisdiction and obligations. Early engagement can affect evidence handling, notification decisions, ransom negotiations, and coverage requirements.

Do not negotiate with or pay an attacker during the first hour. That decision requires legal, executive, technical, and risk analysis, including sanctions and the likelihood that decryption tools or deletion promises will be honored.

When You’ll Encounter It#

You may need this response when users report inaccessible files, widespread file extensions changing, ransom notes, disabled security controls, unexpected domain administrator activity, or a sudden loss of access to servers and cloud services.

The first hour may begin outside business hours, during a maintenance window, or after an alert from an endpoint detection platform. It can also begin with a data extortion message before encryption is visible. In every case, treat credible signs of unauthorized access as an active incident until investigation shows otherwise.

Small organizations should maintain a short emergency contact list with the managed service provider, insurer, legal counsel, incident response firm, and internal decision-maker. Larger organizations should test an incident response plan that includes identity compromise, cloud services, backups, communications, and business continuity.

Technical Notes#

Start with an incident timeline and avoid destructive commands. Useful early checks include identifying active sessions, suspicious processes, and affected hosts from a known-clean administrative system.

Record:
- Detection time and reporting user
- Hostnames, IP addresses, and affected shares
- Ransom note filename and exact wording
- Suspicious usernames, processes, and remote tools
- Security alerts and relevant log timestamps
- Isolation, account, and firewall changes

Example containment actions should be performed through approved tools and validated against the response plan:

1. Isolate confirmed endpoint from the network.
2. Block known malicious hosts and remote administration paths.
3. Suspend suspicious privileged sessions.
4. Restrict backup management access.
5. Preserve endpoint, identity, firewall, and cloud audit logs.
6. Document every action, operator, timestamp, and reason.

Do not rely on a single indicator such as a filename, extension, or ransom note. Attackers may use legitimate administration tools, compromised credentials, and cloud-native services that do not produce obvious malware detections.

Related Terms

• Incident response: The organized process for detecting, containing, investigating, and recovering from a security incident.
• Ransomware containment: Actions that limit an attacker’s access and prevent encryption or data theft from spreading.
• Double extortion: A ransomware tactic combining data theft with encryption and threats to publish the stolen information.
• Out-of-band communications: Communication methods separate from potentially compromised corporate systems.
• Immutable backup: A backup protected from alteration or deletion for a defined retention period.
• Incident commander: The person responsible for coordinating the response, decisions, priorities, and status reporting.
• Business continuity: Plans and procedures for maintaining critical operations during system disruption.

For related defensive practices, see our guides to threat hunting and patch management best practices.

This article may contain affiliate links. We earn a commission on qualifying purchases at no extra cost to you.