Ransomware attack: what to do in the first minutes.

1 · Containment and diagnosis

Once the affected systems are isolated, the team reconstructs the real perimeter of the attack: which ransomware variant, which entry point, which accounts are compromised, how long the attacker has been inside. This phase decides all the others: containing only the encrypted systems while ignoring the attacker's persistent access means reopening the incident after recovery. In Operation Storming Tide the Matanbuchus 3.0 → Astarion → SystemBC chain was cut before encryption precisely because the diagnosis covered the whole chain, not a single host.

2 · Eradication

Removal of every trace of the attacker: malware, backdoors, created accounts, stolen credentials, persistence mechanisms. Ransomware groups often buy their initial access from specialised brokers, as documented in the Nebula Broker analysis: eradicating means closing that entry channel too, not just deleting the payload. Digital forensics establishes what was touched and what was exfiltrated, and produces the evidence the notifications will require.

3 · Recovery from backups

Recovery starts only once eradication is verified: restoring with the attacker still inside leads to re-encryption, one of the most frequent errors in improvised responses. Order of return by business criticality, integrity checks on the backups (ransomware groups hunt them down and encrypt them first), reinforced monitoring on freshly restored systems.

4 · Notifications and communication

In parallel with the technical phases run the obligations above: the national CSIRT for NIS2 entities (early warning within 24 hours) and the supervisory authority for personal data (72 hours). Add internal communication to staff and management, and possibly customers and suppliers: telling different stories to different audiences, or denying exfiltration before forensics has ruled it out, worsens both the legal and the reputational position.

5 · Post-incident review

Once the incident is closed: how did the attacker get in, why wasn't it detected earlier, which controls were missing. The initial vector is almost always known and repeatable, phishing with AiTM kits that capture the session token after authentication, purchased credentials, unpatched exposed systems: if the review doesn't close it, the second attack uses the same door. This is where emergency handling becomes structural prevention, typically with a managed detection and response service or a managed SOC.

Who should handle it: experience is not replaceable

A ransomware attack is not something the internal IT department handles alone, however capable: it takes a qualified incident response team that has already faced and defeated real ransomware groups. The difference is concrete in every phase: recognising the variant and the actor's TTPs cuts diagnosis from days to hours, knowing where groups hide persistence avoids incomplete eradication, having already run the regulatory notifications avoids formal errors under pressure. The Fortgale incident response team operates from its Milan SOC 24·7·365 on documented cases against actors active across Europe, with 287 adversary groups and attack tools profiled to support attribution: knowing the adversary before meeting them is what turns a crisis into a managed incident.

In Operation Storming Tide the Fortgale team contained a multi-stage intrusion (actor Mora_001, chain Matanbuchus 3.0 → Astarion → SystemBC): RClone exfiltration and ransomware prevented by containment.