Learning Ransomware Response & Recovery

Chapter 13. Contain the Attack

You’ve survived the worst 48 hours of your professional life. Your hands still shake when you think about those early panicked calls, the red skull flashing across screens, and the impossible choice between shutting down the network or watching the infection spread. Chapter 9 helped you make it through the fog of war, clouded by the stakeholder conflicts, the exhausted team working 18-hour shifts, and the gut-wrenching decision about whether to pay the ransom.

In Chapters 11 and 12, we shifted gears. You became a detective, methodically identifying the ransomware variant you were dealing with, mapping infections across all systems, confirming that important data was (or was not) exfiltrated, and ruling out any magic decryption solution. You know exactly what hit you and how bad it is.

Now comes the fight that determines everything: stopping this thing from spreading.

Welcome to the containment phase. Get it right, and you can move forward to safely eradicate the threat and recover. Get it wrong, and the ransomware spreads to every corner of your network while you scramble to catch up. Proper containment is what separates organizations that recover in days from those that struggle for months.

Change Healthcare thought they’d contained ALPHV. Three days later, a missed cloud storage infection spread to the backup systems they were counting on for recovery. Northforge contained what they thought was all of Lorenz, only to watch it spread from a system ...