We survived a ransomware drill with one rule: contain before you restore.
The scenario: Monday 8AM, a shared drive full of .lockbit files. Two laptops show the ransom note. The team's first instinct — reimage, restore last night's backup, back to work by lunch — is exactly the move that turns a small event into a second one. Here's the checklist that kept our drill (and later, a real event at a client) from compounding.
Unplug, don't power off
Pull the network cable / kill Wi-Fi on anything showing symptoms. Do NOT shut down: RAM holds evidence, and some strains finish the job on a clean shutdown. One encrypted laptop left on the office switch is how five machines became thirty.
Protect the backup before it's next
Pause cloud sync. Disconnect network-attached backup shares. Ransomware walks mapped drives and sync folders by design — your backup share is the attacker's next target while it's still reachable. The offline copy you can't touch from the network is the whole recovery.
Verify the backup offline before you trust it
Any backup taken after infection started is already encrypted. Compare timestamps against the first symptom, restore the newest clean copy to an isolated machine, and actually open files. Everything still network-attached gets the same suspicion as the patient.
Evidence before wipe
Photograph the ransom note (the ID string identifies the strain), note what changed, capture what you can before reimage. You need it to report to police (ReportCyber in Australia, IC3 in the US) and for the insurer's claim. Wiping first makes all three harder.
The ransom decision belongs to counsel, not adrenaline
Paying funds the next attack, offers no guarantee, and still leaves you with a breach to disclose. Loop in legal and the insurer BEFORE deciding — many policies void coverage if you pay or negotiate without notifying them. Write the decision down either way.
Restore clean, not fast
Rebuild from known-good media and rotate every credential before rejoining the network: passwords, API keys, tokens, VPN accounts. Assume all of them are burned — they usually are. And patch the way in (usually exposed RDP or a VPN without 2FA) BEFORE reconnecting, or day one of your fresh fleet is a re-infection.
Convert the pain into a drill
Four review questions: what did we lose, what alerted (or didn't), what was manual, how long was the offline copy lagging. Then book the quarterly restore test. Teams that recover in days did the drill in peacetime — the drill is the only part of this checklist you can practice before you need it.
The full 48-hour timeline (hour-by-hour card included), free:
→ https://hive80-lab.github.io/ops-notes/ransomware-recovery-checklist.html
If you want the advanced incident-management layer this plugs into, we packaged it as the Ops Starter Kit Vol. 2 ($27) — launch week everything is 30% off with code HIVE-LAUNCH30 (ends tonight, Sep 11 23:30 ACST) at https://hive80lab.gumroad.com
Free starting point: The First 30 Minutes — the one-page quick-start we run first on every incident: https://hive80lab.gumroad.com/l/first-30-minutes
Has your team ever run the offline-restore drill — or is the first real test scheduled for the worst possible week?
Top comments (0)