Ransomware Locked the Office Computer

Why this matters

Ransomware is malicious software that encrypts your files so they cannot be opened, then demands payment for the key. In a small shop it usually lands on the one computer that holds the schedule, the accounting file and the shared drive, and it is discovered at 7:40 on a Monday by the person who has to answer the phones. What happens in the next hour decides whether this is a two-day disruption or a two-month one. The instinct is to fix it: restart, run a scan, or pay and get on with the week. Each of those can make it worse. Stop it spreading first, get the right people on the phone second, and only then work out how it got in.

Monday, 7:40

The office manager at an eight-person electrical shop arrived to find the front-desk computer's wallpaper replaced with a text note: the shop's files had been encrypted, a payment address was given, and the price would double after 72 hours. Every document on the desktop had a new, unfamiliar file extension and would not open. The shared folder on the office network storage box (a NAS, network-attached storage, which every office computer mapped as a drive letter) showed the same thing.

She did the right first thing without knowing why: she did not touch the note, and she called the owner.

Step one: isolate, before anything else

Unplug the network cable from the affected computer and turn off its Wi-Fi. If you cannot do either quickly, shut it down. Isolation stops the software reaching other machines, the NAS and anything else on the network, and it cuts the attacker's connection if one is still open. CISA's ransomware guidance puts isolation first for exactly this reason.

Then, in order:

• Disconnect the NAS from the network too, by pulling its network cable. In this case it was already encrypted, but its snapshot and versioning features might still hold clean copies, and the attacker could still delete them while it stayed connected.
• Check the other office computers for the same note or renamed files, without logging into anything new. Two other machines at this shop looked normal. They were unplugged from the network anyway until someone qualified had looked at them.
• Do not restart, wipe, reinstall or run cleanup tools yet. The computer as it sits is evidence of how the attacker got in. Wiping it now destroys the one record you need to make sure they cannot get back in next week.
• Photograph the ransom note and a screen of renamed files with a phone. You will need the note's wording, any group name and the contact details for your insurer and the investigators.
• Change nothing from that computer. Any password you type on a compromised machine can be captured. Changes happen later, from a clean device.

The general incident procedure, who to call and what to log in the first hour, belongs to its own SOP. See related: The First Hour After a Suspected Breach SOP. Everything below is what ransomware adds.

Step two: the call that decides your options

If you have cyber insurance, call the insurer's breach or claims line before you call anyone else, including an IT person or a recovery company. Most cyber policies require prompt notice and many require you to use the insurer's own panel of forensic investigators, lawyers (often called a breach coach) and negotiators, or they will not pay for vendors you hired yourself. Calling the cheapest local repair shop first can cost you the coverage.

At this shop, the owner found the policy in his email and called its 24-hour line at 8:15. Within two hours a breach coach, a lawyer working for the insurer, had been assigned and had arranged a forensic firm to connect remotely to the isolated machine.

If you have no cyber policy, call your general business insurance agent anyway to ask what your existing policies cover, and engage a reputable incident response firm directly. Report the attack to the FBI's Internet Crime Complaint Center (IC3) in either case; it costs nothing, and law enforcement sometimes holds decryption keys for known variants.

Step three: do not pay on impulse

The 72-hour countdown exists to make you decide before you know what you have. Four reasons to let it run:

• Paying does not guarantee the files back. Decryption tools from attackers are often slow, partial or broken, and some groups never send one.
• Paying may be illegal. The U.S. Treasury's Office of Foreign Assets Control has warned that paying a ransom to a sanctioned person or group can violate federal sanctions law regardless of whether you knew who they were. The insurer's panel checks this before any payment; you cannot check it yourself.
• Paying marks you as a payer. Shops that pay are targeted again, sometimes by the same group through the same unclosed door.
• You may not need to. Whether paying is even on the table depends on what your backups can bring back, which nobody knows yet at 8 in the morning.

The FBI's public position is that victims should not pay. If payment is ever considered, it is a decision for the owner made with the insurer, the breach coach and the forensic firm, after the backup question has been answered. It is never made by an employee responding to the note.

Step four: what the backups could actually restore

The forensic firm's first question was the one that set the rest of the week: what clean copies exist, and how old are they?

• The NAS. Encrypted, because it was mapped as a drive on the infected computer and the ransomware encrypted everything it could reach. Its snapshots were also deleted; the attacker had the administrator password, which was the same password used on the front-desk computer.
• The cloud backup service the shop had added the previous year. It kept versions of every file for 30 days and the office could not delete them from its own computers. That copy was untouched. The newest clean versions were from Saturday at 1:00 in the morning.
• The field-service software and email were cloud services and unaffected; the schedule kept running from phones and the owner's laptop.

So the realistic loss was from Saturday 1:00 to Monday morning, a window in which almost nobody had worked. The shop had tested a restore from the cloud backup three months earlier, so it knew the accounting file would open and roughly how long a full restore took. See related: Testing a Restore Before You Need One. That one fact took payment off the table by 11:00.

The restore itself waited until the forensic firm had finished imaging the infected machine and confirmed where the attacker had come in, because restoring clean files onto a machine with the attacker's door still open simply hands them a fresh set of files. Clean data went onto a new computer, not the old one, on Wednesday. The old computer was kept, switched off, until the insurer released it.

Step five: the trace, and the door that was open

The forensic examination of the isolated computer found the entry point within a day. The owner had set up remote desktop access to the front-desk computer two years earlier so he could do invoicing from home. To make that work, a port on the office router had been opened to the internet, pointing straight at the front-desk machine.

The computer's own security logs showed what came through it:

• Thousands of failed sign-in attempts from the internet against that port over several weeks, which is automated password guessing.
• One successful sign-in on Saturday at 2:13 in the morning, using the account the office shared, with a password that was eight characters long and had also been used on the NAS and on a shopping site that had a public data breach the year before.
• Within an hour of that sign-in, the security software was turned off and the encryption began.

Three things lined up. A door to the internet that nobody remembered was open. A shared account with a reused password. And a NAS mapped as a drive, so the damage reached the shop's whole file store. Remove any one of them and the attack either fails or stays on one computer.

The forensic firm also checked for the second half of a modern attack: copying data out before encrypting it, so the group can threaten to publish it. The logs showed no large outbound transfer, which the breach coach used to work out whether any notification obligation applied. Whether customer or employee data was taken is the question that triggers state breach notification laws, which differ by state, and that question goes through the breach coach or your own attorney, not through an article. This is not legal advice. See related: Handling a Data Breach Notification Obligation.

What the shop changed

• Closed the open remote desktop port on the router. Remote access now goes through a method that requires a second sign-in factor. See related: Turning On Multifactor Authentication Without Locking Yourself Out.
• Ended the shared office account. Each person has their own sign-in. See related: The Shared Login Problem.
• Unmapped the NAS as a drive letter and put its own administrator password in the password manager, unique and long.
• Kept the cloud backup with deletion protection, and added the NAS restore to the quarterly drill rotation.
• Checked the router's other settings, which turned up a default administrator password. See related: Securing the Office Network and a Guest Network.

What would have sent this somewhere worse

The same morning plays out very differently in three cases. If the only backup is a drive always plugged into the office computer, it is encrypted with everything else and the conversation about paying is real. If someone wipes and reinstalls the computer on Monday to get back to work, the shop never learns about the open port, restores its files, and is hit again through the same door. And if the encryption is on a computer that also held customer card data or full Social Security numbers for payroll, the question of what was copied out becomes a notification question with deadlines, and the breach coach call in step two stops being optional.

References

• CISA and partners, #StopRansomware Guide, response checklist
• FBI Internet Crime Complaint Center (IC3), ransomware reporting guidance
• U.S. Treasury, OFAC Updated Advisory on Potential Sanctions Risks for Facilitating Ransomware Payments (2021)
• See related: The First Hour After a Suspected Breach SOP
• See related: Testing a Restore Before You Need One