Learning Ransomware Response & Recovery

Chapter 11. Analyzing the Breach

This chapter builds on the story started in Chapters 9 and 10. You’re still in the fog of war, but you’ve stopped the initial bleeding and are moving to analysis. We will cut through the fog of a ransomware attack, hour by hour. We’ll walk you through identifying the ransomware variant, assessing its scope, and hunting for decryption or remediation options with each step building on your incident response plan (IRP) and detection tools. We’ll dig deeper into Maria’s bakery, Sarah at ZapMart, and Change Healthcare stories, along with a few others, and we’ll share with you a few free tools like VirusTotal and NoMoreRansom.org, plus practical techniques like sandboxing that work for organizations of any size. For those needing advanced forensics like memory analysis or reverse engineering, we’ll cover those specialist techniques in Chapter 12. Survival tips will keep you clear of pitfalls, like scam decryptors or premature containment. Interactive exercises will put you in the Incident Response Team’s shoes, whether you’re an IT manager like Sarah, a small business owner like Maria, or a hospital admin fighting for patient safety.

By the end of this chapter, you’ll have a battle-tested playbook for ransomware attacks and be ready for the next phase, containment and eradication. With ransomware losses projected to hit $57 billion globally in 2025 (according to CyberSecurity Ventures), and AI-driven emerging ransomware strains, this isn’t just a technical ...