Surviving Ransomware: The Anatomy of a Cyber Attack

What Is Ransomware Recovery?

Ransomware recovery is the process of containing a ransomware attack, removing the attacker and restoring systems and data from clean backups without paying the ransom. Its success depends almost entirely on preparation done before the attack: immutable backups, a tested recovery plan and the ability to detect intruders early.

The Modern Ransomware Threat

Ransomware has evolved from simple automated viruses into highly targeted, human-operated campaigns. Today’s threat actors don't just encrypt your files; they steal them first. This is known as double-extortion. If you refuse to pay the ransom to decrypt your files, they threaten to leak your sensitive customer data to the public internet, inviting massive GDPR fines and reputational ruin.

Real-World Scenario: The Friday Night Encryption

The Recovery: Why "Immutable" Backups Matter

In the scenario above, standard backups fail because the attacker encrypts them alongside the production data. A true Business Continuity and Disaster Recovery (BCDR) strategy relies on Immutable Backups.

An immutable backup cannot be altered, deleted, or encrypted by anyone - not even an administrator with full network privileges - for a set period of time.

If the victim in our scenario had an immutable BCDR appliance managed by Dastute, the recovery would look entirely different:

• Immediate Isolation: Endpoint Detection and Response (EDR) software instantly detects the rapid file encryption and physically isolates the infected machines from the network to stop the spread.
• Instant Failover: Rather than spending days reinstalling operating systems and downloading data from the cloud, the BCDR appliance instantly boots up a virtualized copy of the server from the last clean snapshot (e.g., Friday at 11:00 PM).
• Zero Ransom Paid: The business is operational again within 15 minutes, with zero data loss, entirely circumventing the attacker's leverage.

The First 24 Hours: A Ransomware Response Checklist

1. Isolate, don't power off. Disconnect affected machines from the network but leave them running where possible, as memory can hold evidence.
2. Activate your incident response plan. Bring together IT, leadership, legal and communications, and record every decision with a timestamp.
3. Secure your backups. Confirm that backup systems are disconnected and unaffected before the attacker can reach them.
4. Reset credentials. Assume administrator and service accounts are compromised and reset them from a clean device.
5. Identify the scope. Determine which systems are encrypted, what data may have been stolen and how the attacker got in.
6. Notify the right people. Report to the NCSC and Action Fraud, inform your cyber insurer, and assess whether you must notify the ICO.
7. Restore in priority order. Rebuild critical systems from known-clean backups, patch the entry point and monitor closely for the attacker returning.

Should You Pay the Ransom?

The NCSC and UK law enforcement advise organisations not to pay. Payment does not guarantee working decryption keys, does not stop stolen data from being leaked or sold, and marks your organisation as willing to pay, which invites repeat attacks. Payments can also breach sanctions law if the group behind the attack is a sanctioned entity. The most reliable way to avoid facing the decision is to have backups an attacker cannot touch.

Building Ransomware-Resilient Backups

Attackers now deliberately hunt for and delete backups before triggering encryption. A resilient backup strategy follows the 3-2-1-1-0 rule:

• 3 copies of your data,
• 2 different types of storage,
• 1 copy kept off-site,
• 1 copy that is immutable or offline, so it cannot be altered or deleted even with admin credentials,
• 0 errors when restores are tested.

Test restores regularly. A backup that has never been restored is an assumption, not a recovery plan. Our BCDR guide explains how to set recovery time and recovery point objectives for each system.

Ransomware and Your UK GDPR Obligations

If personal data was stolen or made unavailable, the attack is likely to be a personal data breach. Under UK GDPR you must report notifiable breaches to the Information Commissioner's Office (ICO) within 72 hours of becoming aware of them, and tell affected individuals without undue delay when there is a high risk to them. Keep a record of every breach, even those you decide not to report.

How to Prevent Ransomware

• Enforce multi-factor authentication on email, remote access and all admin accounts.
• Patch internet-facing systems quickly, especially VPNs, firewalls and remote desktop services.
• Deploy endpoint detection and response (EDR) with 24/7 SOC monitoring, because attackers often operate overnight and at weekends.
• Train staff to recognise phishing, one of the most common ways attackers get in.
• Apply Zero Trust principles so one compromised account cannot reach every server.
• Validate your defences with regular penetration testing.