Ransomware on the Finance File Server: Restore, Rebuild, or Pay?
At 08:12 on Monday the service desk receives 14 tickets in six minutes: files on FS01 will not open. FS01 is a Windows Server 2019 file server holding 2 TB across 340,000 files, including the finance share. Files now carry a .lckd extension and a README.txt demands 40 BTC. EDR shows a Domain Admin account authenticated over RDP to FS01 at 03:40 from workstation WS-2231, which belongs to a helpdesk supervisor on leave. Antivirus quarantined one binary at 03:52 and logged nothing after that. Agent log retention is 30 days and the console holds 7 days of process telemetry. Backups are Veeam nightly to an on-premises repository that is domain-joined and reachable with the same admin credentials, plus weekly tapes sent offsite; the last tape left Friday. The CISO asks whether to restore or rebuild and whether to involve law enforcement. The CFO wants the finance share back before the 10:00 payroll run.
1. What do you collect in the first two hours, and in what order?
Read the worked answer
Order matters because the fastest-expiring evidence is the most valuable. The EDR console holds only 7 days of process telemetry and is already a day into that window, so export it first, to storage outside the domain.
Then, before any shutdown: memory and volatile state from WS-2231 and FS01 - running processes with command lines, network connections, logged-on sessions, scheduled tasks, services, loaded drivers. The 03:40 RDP session and whatever executed at 03:52 live there.
Next, pull the quarantined binary and its hash from the antivirus console; quarantine stores age out or get purged on cleanup, and that binary is the best source of the encryption routine and any embedded key material. Then collect Windows event logs (4624, 4625, 4672, 4688), RDP operational logs, PowerShell 4104, and Veeam job logs. Disk images of FS01 are lower priority than the above; the encrypted files themselves carry little forensic value beyond confirming extension and note.
Maintain chain of custody: SHA-256 hashes at collection, collector identity, UTC timestamps, copies on media not joined to the domain. Do not reimage either host until these steps are done.
2. How do you determine scope, and how do you decide whether the backups are trustworthy?
Read the worked answer
Two questions in parallel: how far did the attacker get, and can you restore.
Scope: the 03:40 RDP session is the visible event, not necessarily the first. Search 30 days of logon events for the Domain Admin account and WS-2231, and look for new services, scheduled tasks, remote-execution artefacts, and the account appearing on other servers. Because the account was used interactively, assume credential theft and plan a double krbtgt reset plus rotation of all Domain Admin credentials.
Backups: the repository is domain-joined and reachable with the same credentials, so treat it as in scope until proven otherwise. Check for .lckd files in restore points, deleted or expired jobs, changed schedules, and logons to the backup server from WS-2231 or the Domain Admin account. If Veeam was untouched and restore points predate 03:40, you have a clean recovery point - but verify by test-restoring two files to an isolated host and opening them before committing to a full restore.
If the repository is compromised, Friday's offsite tape is the fallback: it left the building before the intrusion, which makes it the most trustworthy artefact you hold. Confirm tape completeness and catalog before relying on it.
3. Do you restore or rebuild, do you meet the payroll deadline, and do you call law enforcement?
Read the worked answer
Rebuild the operating system; restore only data. Reimaging removes persistence you have not yet found, and the cost of a rebuild is hours while the cost of a missed backdoor is a second incident. Restore to clean hardware or a clean VM and re-share from there - never restore over FS01.
Payroll: 340,000 files will not come back reliably in 90 minutes. Do a targeted restore of the payroll dataset from the last known-good point, tell the CFO the run may slip, and do not let a payroll deadline drive a ransom payment. If the Veeam repository is clean, restore Friday full plus incrementals; if not, the tape.
Law enforcement: follow policy and jurisdiction. The decision to report is usually straightforward for a ransomware intrusion, but the more consequential determination is whether notification obligations are triggered - check for exfiltration by reviewing outbound volume from FS01 and WS-2231 before concluding. Preserve the ransom note and contact channel; do not engage the actor without legal and incident-response lead approval. Loop in the insurer and counsel early, because payment decisions and privilege claims belong to them, not to the technical team.