Ransomware Containment Playbook: The First 60 Minutes of an Attack
The precise tactical steps IT and security teams must execute during the critical first hour of active encryption to stop lateral spread.
The Critical Golden Hour
When ransomware begins encrypting files and dropping ransom notes, panic is the adversary's greatest asset. Immediate, disciplined execution of containment actions determines whether the breach is isolated to a few endpoints or paralyzes the entire enterprise.
Step 1: Network Isolation Over Powering Down
Never power down or reboot infected systems. Powering down purges volatile RAM memory where encryption keys, injection processes, and adversary IP connections reside. Instead, disconnect network cables or execute host isolation via your EDR agent.
Step 2: Emergency Active Directory & Cloud Credentials Reset
Immediately revoke all active Kerberos ticket-granting tickets (TGT) by resetting the `krbtgt` account password twice on domain controllers. Terminate active cloud sessions and reset all global administrative credentials from an uncompromised out-of-band device.
Step 3: Preserve Offline and Air-Gapped Backups
Physically disconnect backup storage appliances, immutability arrays, and tape systems from the network before attackers or scheduled scripts execute backup deletion routines.
Related Articles & Advisories
Building Immutable and Air-Gapped Backups to Defeat Modern Ransomware
Architecting WORM storage, isolated management planes, and zero-trust recovery vaults that attackers cannot delete or encrypt.
Digital Forensic Readiness: Ensuring Logs Are Retained, Centralized & Tamper-Proof
How to ensure your enterprise collects the forensic telemetry needed to satisfy law enforcement, cyber insurers, and regulatory auditors.
BCDR Under Fire: Designing Realistic Cyber Incident Tabletop Simulations
Moving beyond gentle tabletop exercises to stress-test executive decision making, communications, and technical recovery under pressure.