Ransomware: the first ten minutes

Ransomware spreads through the network in minutes. The person who notices first decides how bad it gets. Learn the signs and the four moves.

What ransomware is

Ransomware is a program that scrambles (encrypts) every file it can reach, on the computer it landed on and on any shared drive or synced folder that computer can see, then leaves a note demanding payment for the key. Modern gangs also copy the files first and threaten to publish them, so a good backup alone does not end the problem.

It gets in the usual ways: an attachment that asked you to “enable content”, a link to a fake download, a stolen password used to log in remotely, or an unpatched device. Everything in lessons 2 to 5 is ransomware prevention. This lesson is about what to do when prevention fails.

IBM’s four-minute explainer shows how an attack unfolds and why backups decide the outcome.

Video: What is Ransomware? · IBM Technology · 4 minListen for the two parts of a modern attack: encrypting files and copying them first to threaten publication.Watch on YouTube (opens in a new tab)

The early signs

Ransomware does not announce itself first. It works for a few minutes before the note appears. If you notice any of these, act immediately:

Sign What is happening
File names change to odd endings (.locked, .crypt, random letters) Files are being encrypted one by one
Documents will not open, or open as gibberish Already encrypted
New text or HTML files appear in folders with names like HOW_TO_RECOVER or README The ransom note is being dropped
The computer slows to a crawl and the disk light stays on Encryption is running
Desktop background changes to a message The attack is finishing
Antivirus turns itself off or will not open Malware is disabling defenses
A shared folder shows the same symptoms on another person’s computer It has spread. Everyone needs to know now.

What a shared folder looks like in the minutes before the ransom note appears.

A mock file explorer for Shared Accounting where Invoices, Payroll, Customers and Contracts files have gained a .locked ending, a new HOW_TO_RECOVER.txt file has appeared, one file will not open, and a status line says real-time protection is off with the disk at 100 percent; callouts explain files are being encrypted one by one, the ransom note is being dropped, defenses are off, and the right move is to turn off Wi-Fi or pull the cable, then call and say ransomware
Renamed files, a new README, antivirus that will not turn on. If you see this, disconnect first and call second.

The four moves

Memorize these in order. They are the same whether you are the owner or the newest hire.

  1. Disconnect the device from the network. Turn off Wi-Fi or unplug the network cable. This stops it reaching shared drives and other computers. If you cannot disconnect it, powering it off is the fallback, not the first choice.
  2. Leave it on and stop using it. Do not click the note, do not try to open files, do not run a cleanup tool. Investigators can learn from a machine that is still running.
  3. Call IT or your manager by phone and say the word “ransomware”. Not email: email may be affected, and the word gets the right response fast.
  4. Do not pay, reply, or plug in backup drives until IT says so. A backup drive connected now gets encrypted too. Paying funds the next attack and often does not return the files.

Then warn coworkers in person or by phone not to open the message or file that started it, if you know what it was.

The four moves, in the order they happen.

Four numbered cards: 1 disconnect from the network by turning off Wi-Fi or unplugging the cable, powering off only if you cannot disconnect; 2 leave it on and stop using it, do not click the note or run a cleanup tool because a running machine holds the evidence; 3 call IT or your manager by phone and say ransomware, not by email; 4 do not pay, reply or plug in backup drives until IT says so, because a drive plugged in now gets encrypted too
Disconnect, leave it on, call and say the word, do not pay or plug anything in. The order matters: disconnecting first is what keeps it to one machine.

Backups are the real answer

A business recovers from ransomware in hours if its backups are good, or never if they are not. “Good” means:

  • Offline or versioned. A backup drive that stays plugged in gets encrypted with everything else. Cloud storage with version history (Drive, OneDrive, Dropbox) lets you roll files back; a disconnected drive rotated weekly works too.
  • Tested. Someone has actually restored a file from the backup in the last few months.
  • Complete. The point-of-sale data, the accounting file and the customer list are included, not just the shared folder.

If you are not the person who manages backups, you can still ask one question: “When did we last restore something from backup to check it works?”

What happens next

After you make the call, IT or an outside responder will isolate the affected devices, find out how it got in, restore from backups, reset passwords and decide whether customers or regulators must be told. Your part is done once you have disconnected, called, and written down what you saw and when. Expect to be asked what you opened or clicked in the last hour; answer plainly.

Try it now

Find the Wi-Fi switch on the computer you use most and practice turning it off and on. Then find out who you would call, and whether they are reachable by phone rather than email. Those two facts are most of your ransomware plan.

Remember: disconnect, leave it on, call and say “ransomware”, do not pay or plug in backups. The first person to notice and act decides whether it is one computer or the whole business.

Checking your progress…