Ransomware Attack: First Aid for the First Hours

The timeline is a TOMORIS recommendation based on the sources cited. CISA, MS-ISAC, NSA, and FBI recommend working through the first three steps in order: isolate, power down only if necessary, triage for recovery (Part 2, steps 1 to 3). Only the reporting deadlines are required by law (section 07).

According to the BSI, an infection usually takes effect after a few days to two weeks; encryption often happens at night or on weekends (chapter 4.1). You should expect data to have been exfiltrated (summary).

Warning signs according to the Federal Criminal Police Office: files cannot be opened or have new extensions, a ransom demand appears, systems become unusually slow, security software is disabled, accounts are locked, data is transferred unusually (information sheet, prevention page).

Basic rule: disconnect from the network, do not shut down. For step 2, CISA essentially states: power down devices only if they cannot be disconnected from the network. Doing so prevents infection artifacts and potential evidence in volatile memory from being preserved, and should only happen if the network can neither be taken offline temporarily nor the host be disconnected another way. For forensics, the BSI recommends: first take an image of the main memory, then cut the power hard instead of shutting down (chapter 4.3).

• Identify affected systems and isolate them immediately, critical systems first (CISA, step 1).
• If many systems are affected, disconnect the network at the switch, ideally all at the same time (CISA, step 1; BSI, chapter 4.9).
• Otherwise, unplug the network cable and disconnect Wi-Fi, do not shut down the device (BSI, summary; Federal Criminal Police Office).
• Isolate in a coordinated way and coordinate by phone: attackers may be watching whether they have been detected and may otherwise deploy the ransomware widely beforehand (CISA, step 1).
• Create snapshots of the volumes for affected cloud resources (CISA, step 1).
• Do not sign in with administrator accounts on infected systems while they are connected to the network (BSI, chapter 4.2).
• Note the time you became aware (TOMORIS recommendation, deadlines under § 34 para. 2 NISG 2026); notify the emergency team, IT service provider, and cyber insurer (Federal Criminal Police Office; BSI, chapter 3.6).

Every action on a compromised system can alter traces; work only on copies wherever possible (BSI, chapter 4.3). For a criminal complaint, evidence must be collected in a court-admissible way and events documented; if you have no forensic capability of your own, get external help early (chapter 3.7).

• Create images of the main memory and storage drives of a selection of affected devices, including virtual and cloud servers (CISA, step 9); on a running system, take only the memory image (BSI, chapter 4.3).
• Secure storage drives as a forensic 1:1 image, which standard backup programs usually cannot do; for virtual machines, secure the virtualization directory (BSI, chapter 4.3).
• Volatile data first: main memory, Windows security logs, firewall log buffers (CISA, step 9).
• Secure logs from the proxy, email server, firewall, Active Directory, and file access (BSI, chapter 4.4).
• Keep malware samples, indicators of compromise, the ransom note, encrypted sample files, and the communication with the attackers (CISA, step 9 and box at step 7).
• Log times, observations, and decisions, save screenshots (Federal Criminal Police Office, information sheet; BSI, chapter 3.7).

Intrusions often involve mass credential theft (CISA, step 13). All credentials stored on affected systems or entered there after the infection are considered compromised (BSI, summary).

• Immediately turn off external access: VPN, remote access servers, single sign-on, and publicly accessible cloud access (CISA, step 13).
• Identify the systems and accounts of the initial intrusion, including email accounts, and check all administrator accounts for legitimacy (CISA, step 12; BSI, chapter 4.2).
• TOMORIS recommendation: change access credentials that attackers could use from outside immediately and only from clean devices (Federal Criminal Police Office: "change credentials without delay"; BSI, chapter 4.9).
• After the cleanup, change all administrator and service passwords as well as all passwords entered on infected systems, including in browsers, email programs, RDP connections, and line-of-business applications (BSI, chapter 4.9; CISA, step 17).
• If Active Directory is compromised and cannot be rebuilt immediately: reset the password of the KRBTGT account twice to invalidate forged Kerberos tickets (BSI, chapter 4.9).
• Block unnecessary remote access for about 2 to 3 weeks, log and evaluate connection attempts (BSI, chapter 4.9).

The authorities unanimously advise against it. The Federal Criminal Police Office: "Do not pay a ransom"; a payment guarantees neither decryption nor the deletion of stolen data, and those who pay may be targeted again (prevention page, information sheet). The BSI: as a rule, do not give in to the extortion, but restore from intact backups after the cleanup (chapter 3.9). CISA, FBI, NSA, and MS-ISAC do not recommend paying because it guarantees neither decryption nor protection against publication (box at the beginning of Part 2). If payment is nevertheless considered, the BSI names these points (chapter 3.9):

• Involve the cyber insurer early; it often sets conditions for covering costs.
• Clarify with law enforcement and legal counsel: payments may finance further attacks on third parties.
• There is no guarantee of a matching key; demand the decryption of a few sample files in advance.
• Rebuild systems even after decryption because backdoors may remain; after a payment, inform the police.

Check for free decryption: for some variants, tools are available from No More Ransom (nomoreransom.org), an initiative of the Dutch police, Europol, and IT security companies; the Federal Criminal Police Office explicitly refers to it (prevention page). Not every variant can be decrypted. Remove the malware first; otherwise, the data will be encrypted again (No More Ransom). TOMORIS recommendation: work on copies of the encrypted data.

If the publication of stolen data is threatened, have the attackers' leak site monitored, for example by a service provider. If data is published, analyze it and inform the affected persons about the facts and the risk (BSI, chapters 3.7 and 3.8). Also ask law enforcement about available decryption tools (CISA, step 10).

Essential and important entities report every significant cybersecurity incident (§ 34 para. 1 NISG 2026). An incident is significant if it has caused or is capable of causing severe operational disruption or financial loss, or has affected or is capable of affecting others by causing considerable damage (§ 35 para. 1). Under the NISV 2026 (Austrian NIS Regulation 2026), it is significant in any case if, among other things, there has been successful, suspectedly malicious, unauthorized access that is likely to cause severe operational disruption, or if it triggers disaster recovery plans (§ 5 para. 1 nos. 5 and 9; according to the explanatory notes for entities outside Implementing Regulation 2024/2690). A personal data breach also includes the destruction and loss of personal data, not only its exfiltration (Art. 4(12) GDPR).

• The CSIRT responds no later than 24 hours after receiving the early warning and, if a criminal background is suspected, provides guidance on reporting to law enforcement (§ 34 para. 4 NISG 2026).
• The Cybercrime Reporting Office of the Federal Criminal Police Office (against-cybercrime@bmi.gv.at) helps with suspicions and questions; it does not currently accept criminal complaints, which you file at a police station (Federal Criminal Police Office, Cybercrime). Bring the affected device with you if possible (prevention page).

In the legislative process: With the Digital Omnibus, the European Commission proposes that data breaches be reported only if there is likely a high risk, and where feasible within 96 hours (COM(2025) 837 of November 19, 2025). Procedure 2025/0360(COD) is open; according to the Legislative Observatory, the committee decision in the European Parliament is pending (as of October 25, 2026). Until then, the 72 hours under Art. 33 GDPR apply.

1. 1

   Classify and prioritize services

   Classify each service: not affected, can be outsourced, possible to a limited extent with a mobile, unaffected device, not possible without a rebuild (BSI, chapter 3.4). Restoration follows a previously created list of critical systems and the systems they depend on (CISA, step 3).

2. 2

   Build a clean environment

   Start with a core network for critical business processes and expand it systematically (BSI, chapter 4.9). Only clean systems go into a dedicated VLAN for recovery (CISA, step 19).

3. 3

   Rebuild instead of cleaning

   Infected systems are considered fully compromised: rebuild, update, and harden them before they go back online. A compromised Active Directory must be rebuilt in the long term (BSI, summary and chapter 4.9).

4. 4

   Check and protect backups

   First find the precursor malware; otherwise, the compromise continues after restoration (CISA, step 4). Work with copies of the backups and insert tapes write-protected so that overlooked infected systems cannot infect them afterward (BSI, chapter 4.9).

5. 5

   Restore and close out

   Restore data from offline backups according to the priority of critical services (CISA, step 19). The designated IT or IT security lead declares the incident over according to defined criteria (step 18).

Set up emergency operations in parallel: data important for emergency operations may still be stored at unaffected branch offices or on the devices of employees who are on vacation (BSI, summary). For employees who can hardly work without IT, find meaningful tasks during emergency operations (chapter 3.2).

• Do not sign in with administrator accounts on infected systems while they are connected to the network (BSI, chapter 4.2).
• Do not shut down as long as the device can be disconnected from the network another way (BSI, summary; CISA, step 2).
• Do not coordinate over channels that attackers could be reading, such as the affected email system (CISA, step 1).
• Do not delete the ransom note; otherwise, decryption may fail (CISA, box at step 7).
• Do not clean only the conspicuous system or merely run the antivirus scanner (BSI, chapter 4.1, annex 6.6).
• Do not connect backups to systems that are not proven to be clean (BSI, chapter 4.9).
• Do not stay silent, do not blame anyone, do not send links in emails to customers (BSI, chapter 3.3, annex 6.6).
• Do not forget the reporting deadlines: the 24 hours run from the time you became aware (§ 34 para. 2 no. 1 NISG 2026).

• Debriefing: What went well, what needs to be improved, which long-term measures follow? Then have the IT reviewed by external parties (BSI, chapter 3.10).
• Document lessons learned and incorporate them into policies, plans, procedures, and exercises (CISA, step 20).
• Maintain the emergency plan, exercise it regularly, and keep it available on paper and offline as well (CISA, Part 1).

Enter the contacts in advance, as CISA recommends with its contact table (Contact Information section, Table 1), and keep the list available on paper as well. The list is a TOMORIS template for you to adapt.