Ransomware doesn't announce itself. At 2:04am you get an alert - or worse, a phone call from a night-shift tech who says the file server "seems slow". Here is the first 30 minutes, written for a team of one to ten engineers with no SOC, no retainer, and no budget for a $500/month monitoring stack.
Minutes 0-5: confirm or deny
Do not touch the infected machine. From a clean device:
- Check whether the file server is still writing files, and whether extensions changed (.locked, .crypt, .enc, .rmallo).
- Look for a ransom note: READ_ME.txt, HOW_TO_DECRYPT.txt, or a new text file on the desktop of any file share.
- One yes to either means: it is not "slow", it is an incident.
Minutes 5-15: stop the spread
- Disconnect infected hosts from the network - pull the cable, do not shut down (RAM and running state matter for forensics).
- Isolate the backup target NOW. Ransomware's favourite move is encrypting your backups too. Unplug or firewall it.
- Disable VPN and remote desktop access if credentials may be stolen.
- Change privileged passwords from a clean machine, starting with domain admin and backup service accounts.
Minutes 15-30: decide the recovery line
Answer two questions in writing:
- What is the last known-clean backup, and has anyone verified it restores?
- Who decides whether to pay, restore, or call outside help? (Write the name down before the pressure starts.)
That single written line - "restore from backup X, taken at time Y, verified by person Z" - is what separates teams that recover in a day from teams that lose a week.
What most small teams get wrong
- Backups restore-tested never. An unverified backup is a hope, not a plan.
- No written escalation path, so the first 30 minutes become 3 hours of guessing who to call.
- Remote access left wide open, which is how ransomware got in the first place.
The checklist version
We packaged this as a free quick-start playbook (the first 30 minutes, printable, with the exact commands and decision points):
- Free quick-start (first 30 minutes): https://hive80lab.gumroad.com/l/first-30-minutes
- Ops Starter Kit, $14 one-time - IR plan templates, backup verification drill, escalation ladder: https://hive80lab.gumroad.com/l/ops-starter-kit
- Agent Ops 24/7 - keeping an unattended 24/7 operation healthy, the same discipline for your automation: https://hive80lab.gumroad.com/l/agent-ops-24-7
- Automation Starter Pack - the monitoring scripts that catch this at minute zero: https://hive80lab.gumroad.com/l/automation-starter-pack
LAUNCH50 gives 50% off the paid kits while the launch window is open.
Have you run a restore test this quarter? If the honest answer is no, the free quick-start is the fastest fix.
Top comments (0)