Modern ransomware can't be decrypted by anyone except the original attackers. So the question becomes what survived. Shadow copies it failed to clear and unencrypted originals still sitting in free space remained intact, as well as files that were never accessed and backups which it could not access. We will determine what can be recovered, at no cost to you, before you decide anything about payment.
Disconnect the network cables but leave running machines powered on — shadow copies and material held only in memory can be lost upon restarting. Keep all encrypted files — there is no cost associated with keeping these files around and sometimes they are useful again later.
They are ordered by how much difference each makes, and none of these items have a cost associated with them.
It will prevent the malware from spreading to network shares or NAS devices. Shutting down your system completely means losing all the volatile evidence and can delete any shadow copy that managed to survive the malware as well.
This is a hard habit to break and it ruins the artefacts that show what left the network — you may need these for the ICO and almost certainly for your insurer.
Not whether one exists. When it last ran, and whether it was reachable from the infected network. Whether anyone has restored anything from it recently. The backups that were placed on a mapped drive are typically encrypted as well.
The strain name and contact information identify the “family” — this will determine if there is a free decryptor available and how the attack operates.
You’re being pressured by the negotiation clock. Your negotiating power is determined solely by knowing what can be recovered without paying.
It is worth stating plainly, because a significant portion of this industry is vague about it.
Currently, ransomware encrypts each individual file with its own unique randomly generated symmetric key. Then, these keys are sealed using the attacker's public key. Since breaking one file does not provide access to another file, and the master key resides solely on the attacker's end, there is no "gap" a professional closes; this is simply correct implementation of cryptography doing precisely what it was intended to do.
When a free decryptor exists, it can typically be obtained from the No More Ransom project, which provides a decryptor for a particular ransomware family based on an identified flaw in their implementation. We initially look for these free decryptors since they cost nothing. When no such decryptor exists, any company claiming to offer decryption service is either describing a previous version of the same malware that has been previously defeated, or the company is actually offering to pay the ransom on behalf of the customer at some additional charge.
In reality, the majority of information that is recovered post-attack was never properly encrypted by the attackers.
These two conversations take place simultaneously while you address the technical issues associated with the initial breach. These two conversations will be influenced by many decisions taken during the first day.
Your insurer. Most cyber insurance policies state that the affected systems should remain intact for forensic analysis. Deleting and restoring the affected systems prior to having the designated assessor from the insurer look at them can often lead to disputes about whether there was ever a valid claim. This occurs typically due to the fact that all of the evidence of what occurred is deleted when the systems are restored. Review the policy language before doing anything and if there is an incident hotline number listed on it call it immediately.
The regulator. If personal information may have been accessed then under UK GDPR you have 72 hours to determine and possibly notify others. The question the ICO asks is not whether files were encrypted but whether any data was removed from your network. All of these answers are recorded in log files, connection records and artefacts that will be lost once you restore/replace the breached server(s). Creating an image of the systems as read only before doing anything else allows you to preserve your ability to provide an answer and does not cost anything additional.
Worth listing them together, as they reflect the real decision you will be making.
The recovery on servers, NAS units and RAID systems starts from £500 +VAT, whilst a single workstation is priced from £300 +VAT. The price is agreed in advance with both being included as part of our written agreement once your initial free 48-hour assessment to find out what was saved before committing to recover anything has been completed.
In comparison to the costs of paying a ransom demand by attackers, these amounts represent a small portion of the total amount demanded. For example, typical ransom demands by attackers towards UK SMEs tend to be in the tens of thousands. While paying a ransom demand will likely provide a decryption tool for use on encrypted data, there is no guarantee that such tools will work on all files, and paying does not delete anything already copied out. In contrast, recovering around the attack represents a tangible solution to a problem created by attackers and does so without relying upon the actions of those same attackers. There is also no commission taken by our company on anything recovered and no part taken in negotiating with attackers, and therefore, we have no incentive to overestimate the number of recoverable files.
Please send us your device along with a brief description of what happened. This diagnostic process has no cost and the price for the next phase of service will be fixed in writing prior to commencing work.
This is the only step that requires input from you and nothing else can happen until the device is on our bench. Package your item properly and include all the information we require about you and your item(s), then ship them to us. Then comes a no-cost diagnostic, followed by a written quote.
Posting it? Use a tracked and insured service. The value of what is on the drive far exceeds the cost of postage. Bringing it in? Weekdays from 9am to 5:30pm, and it still needs packing as described above for the journey.
Tell us about the item in question, tell us how it has been behaving lately, and let us know if there is anything you have done as far as troubleshooting goes so that our engineers may provide a realistic estimate of success and a probable cost range prior to sending your items off.
We’ll be in touch shortly. If it’s urgent, call 0161 871 0788.
Questions we receive most frequently about ransomware attacks.
No, and neither can anybody else for a current strain. Each file is separately encrypted and each file is encrypted with its own unique key which is then sealed with the attackers' public key. The 'master' key exists solely on the attackers' end. If there is a previously identified weakness within an older family of malware, there may be a free decryptor available via No More Ransom (which we check first, at no charge).
That is exactly what the free assessment answers, and there's enormous variation — from virtually all of it to very little — depending upon how many shadow copies are still available, if original data still exists in unallocated space, and how far along in the process the ransomware got. A figure is provided before you commit to anything.
Disconnect them from the network; let running systems stay powered up. Disconnection will stop a potential propagation issue; restarting can remove shadow copies and other memory-based items which would have otherwise been able to be recovered.
Very likely encrypted along with everything else, since most ransomware families today use mapped drives and networked shares intentionally. Generally speaking, most items that tend to survive are those items that were offline, immutable or on a system the attacker was unable to authenticate against.
If you determine that personal data may have been either viewed/accessed/exfiltrated from within your environment, you'll have 72 hours to evaluate and possibly inform. This question boils down to whether the attackers actually took your data out of your network, and again the answer depends on artefacts destroyed by the rebuild process – which is why we always create an image first.
No. We are not going to engage in either negotiating with them or handling payment. We will take no percentage of anything recovered. We don’t have a reason to exaggerate on how much data may be retrievable – the assessment is as stated.
We identify the families by name; put the numbers in writing; and retrieve data from workstations, NAS and servers – while keeping evidence that supports your insurance claims. Contact us now.