Ransomware Incident Response Playbook

Step 1: Identify the Infection

# Look for suspicious processes
ps auxf | grep -iE "encrypt|ransom|lock|crypt"

# Find recently modified/encrypted files
find / -name "*.locked" -o -name "*.encrypted" -o -name "*.crypt" 2>/dev/null
find / -name "*DECRYPT*" -o -name "*ransom*" -newer /tmp -mmin -60 2>/dev/null

# Find ransom notes
find / -name "README.txt" -newer /var/log/syslog -mmin -120 2>/dev/null
find / -name "*HELP*" -mmin -60 2>/dev/null

# Check recently created files
find /home /var/www /tmp -mmin -60 -type f 2>/dev/null | head -30

Step 2: Isolate the Infected System

# Disable all network interfaces immediately
sudo ip link set eth0 down
sudo ip link set wlan0 down

# Or disable NetworkManager
sudo systemctl stop NetworkManager

# Block all outbound traffic via firewall
sudo iptables -P OUTPUT DROP
sudo iptables -P INPUT DROP
sudo iptables -P FORWARD DROP

# On Windows:
# netsh advfirewall set allprofiles state on
# netsh advfirewall firewall add rule name="BLOCK_ALL" dir=out action=block

Step 3: Preserve Forensic Evidence

# Take a RAM dump (before rebooting — encryption keys may be in memory)
sudo lime-forensics -o /evidence/memory.lime -f lime

# Or use avml
sudo avml /evidence/memory.avml

# Create a bit-for-bit disk image
sudo dd if=/dev/sda of=/evidence/disk.img bs=4M status=progress

# Calculate hash to verify integrity
sha256sum /evidence/disk.img > /evidence/disk.img.sha256

# List all running processes (snapshot)
ps auxf > /evidence/processes.txt
netstat -tlnp > /evidence/network.txt
lsof -i > /evidence/open_files.txt

Step 4: Identify the Ransomware Family

# Check file extensions being used
ls -la /home/user/Documents/ | grep -E ".(locked|encrypted|crypt|ransom)"

# Submit ransom note/sample to ID Ransomware:
# https://id-ransomware.malwarehunterteam.com/

# Check file hash against VirusTotal
sha256sum /path/to/suspicious_binary
# Submit hash to virustotal.com

# Check known CVEs related to the ransomware variant:
# https://zentriontechnologies.com/tools/cve-lookup

Step 5: Find Persistence Mechanisms

# Cron jobs
crontab -l
cat /etc/crontab
ls -la /etc/cron.{d,daily,hourly,monthly,weekly}/

# Startup scripts
cat /etc/rc.local
ls /etc/systemd/system/*.service

# Check recently added systemd services
systemctl list-units --type=service --state=running
systemctl list-units --type=service | grep -v "(generated)"

# Bash history
cat ~/.bash_history | tail -50

Step 6: Network Investigation

# Check established connections at time of infection
netstat -tlnp
ss -tlnp

# Look for unusual outbound connections
netstat -anp | grep ESTABLISHED | grep -v "127.0.0.1|::1"

# Check DNS resolution logs (C2 domains)
journalctl -u systemd-resolved | grep -i "query|response"

# Check for lateral movement
grep -i "ssh|rdp|smb" /var/log/auth.log | tail -50

Step 7: Restore from Backup

# Verify backup integrity before restoring
sha256sum /backup/clean-backup.tar.gz
cat /backup/clean-backup.tar.gz.sha256   # Compare

# Restore (wipe infected system first)
tar -xzf /backup/clean-backup-2026-09-10.tar.gz -C /restore/

# Restore from snapshot (if using ZFS/LVM/btrfs)
# ZFS: zfs rollback tank/data@clean-snapshot
# LVM: lvconvert --merge /dev/vg0/data_snapshot

Prevention Checklist

• 3-2-1 Backup Rule: 3 copies, 2 media types, 1 offsite
• Apply security patches within 24h of release — check for CVEs: CVE Lookup →
• Deploy EDR (Endpoint Detection & Response) software
• Restrict RDP/SMB — never expose to internet
• Use strong, unique passwords — Generator →
• Enable DMARC/SPF to prevent phishing emails: SPF Checker →
• Segment network — isolate critical systems
• Train staff to recognise phishing