Quick Answer

  • Hour 0-1: Isolate affected systems from the network, capture a RAM image and volatile evidence, and document the ransom note and extensions.
  • Hour 1-3: File a cyber incident notification to USOM within 3 hours, inform senior management and the legal unit, and form the crisis team.
  • Hour 3-6: Verify the integrity of backups and that they are not encrypted, test the restore scenario in a test environment, and collect IOCs.
  • Hour 6-12: Assess the impact on personal data within the scope of KVKK, and begin preparing the file for the 72-hour Board notification.
  • Hour 12-24: Begin a controlled restore to a clean environment, conduct root cause analysis, and finalize the ransom decision alongside the communication and legal strategy.

In a ransomware incident, the first 24 hours disproportionately determine the course of the incident, its legal cost and brand reputation. ENISA's Threat Landscape 2024 report identifies a strong negative correlation between the average isolation time of ransomware attacks and the data exfiltration loss rate. The Microsoft Incident Response Playbook states that the first four-hour decision windows have seven times the impact of the following days. NIST SP 800-61 Revision 2 shows statistically that teams which preserve the balance between speed and accuracy achieve faster recovery.

This guide divides the period from the T0 moment when ransomware is detected to T+24 hours into five separate windows. For each window there is a concrete checklist, output, owner and mistakes to watch out for.

Section 1. The T0 Moment, Detection of the Incident

Ransomware can be reported through four different channels.

  1. User report. A "my files won't open, I saw a ransom note" call.
  2. EDR / XDR alert. Suspicious bulk file renaming, a shadow copy deletion command.
  3. SIEM alert. Abnormal activity on the domain controller, a storm of Kerberos errors.
  4. External notification. The threat actor contacts you directly by email, or an announcement is seen on the dark web.

T0 is the moment when the first suspicion becomes meaningful with reasonable justification. This timestamp is the starting point of the KVKK 72-hour and USOM 3-hour counters. Incorrect timestamping becomes an aggravating factor in a later Board examination.

Section 2. Window 1, 0-1 Hour. Isolation and Volatile Evidence

This window has a single goal: that no more machines are encrypted and that volatile evidence is not lost. Checking backup integrity comes not in this hour but in the next window.

2.1. 0-1 hour checklist

No. Action Owner Output
1 Isolate the affected machine from the network (EDR isolation or physical cable) SOC Isolation record
2 RAM dump (WinPMem, FTK Imager Lite) over a write-protected USB Digital forensics team Hashed image
3 Ransom note, screenshot, file extension samples Detector Evidence package
4 Opening and classifying the incident ticket SOC Incident number
5 Chain of command call, CISO, IT manager SOC shift Call record
6 First estimate of the number of affected machines IT Preliminary inventory
7 Isolation of the backup infrastructure (so the attacker cannot reach backups) Backup team Backup isolation record
8 Placing Domain Controller logs under additional protection DC administrator Log protection report

2.2. Warnings specific to this window

Do not reboot. Do not power off the machine. Do not move to a disk image before the RAM dump is complete. Do not attempt manual cleanup with antivirus, this can destroy IoCs. Do not open the attacker channel early by saying "let us talk so the ransom goes down."

2.3. Volatility 3 first artifact list

The artifacts that must be extracted urgently after the first RAM dump is taken are listed below.

Plugin Output
windows.pslist Active process list
windows.pstree Parent-child relationship tree
windows.netscan Network connections, listening ports
windows.cmdline Each process's command line
windows.malfind Code injection regions
windows.handles Open handles (especially named pipes)
windows.svcscan Registered services and their states
windows.dlllist Loaded DLLs

These outputs reveal the attacker's C2 IP address, the path of the binaries used, and lateral movement tools. The IoC set obtained at the end of the first window doubles the efficiency of the following windows.

Section 3. Window 2, 1-3 Hours. TLP Determination, USOM Notification, Call Chain

This is the window where the legal and communication dimension joins the incident. While the technical work continues, two parallel tracks open.

3.1. 1-3 hour checklist

No. Action Owner Output
1 TLP (Traffic Light Protocol) determination, sharing scope CISO TLP label
2 Assessment of the USOM 3-hour notification obligation Legal + CISO USOM decision
3 If critical infrastructure sector, USOM notification submission Legal Notification ID
4 Senior management briefing (CEO and, if appropriate, the board chair) CISO Briefing note
5 Formal involvement of legal counsel in the process General Manager Legal note
6 Review of the cyber insurance policy, preliminary notice to the insurer Legal + Finance Insurance file
7 Preliminary KVKK category assessment (is there special category data) KVKK contact person Category note
8 Calling the external digital forensics provider (DSET) CISO Call record
9 Informing the communications director (no announcement yet) General Manager Internal information note
10 Setting up a physical or virtual incident war room CISO office Room access list

3.2. TLP determination

The Traffic Light Protocol is a sharing classification standard developed by FIRST.org. In a ransomware incident, typical labeling is as follows.

Label Meaning Typical use
TLP:RED Meeting participants only Internal chain-of-command meeting
TLP:AMBER Shared internally only IT team, legal, senior management
TLP:AMBER+STRICT Specific people within the organization Incident team only
TLP:GREEN Community sharing Sector ISAC, USOM
TLP:CLEAR Public Post-incident reporting

3.3. USOM notification note

The National Cyber Incident Response Center operates the obligation to report cyber incidents in critical infrastructure sectors within the framework of the Council of Ministers Decision No. 2013/4890 dated 5/11/2013. Notification can be made via usom.gov.tr or over the 24/7 line. Sectoral SOMEs work in coordination with USOM. Although the notification period varies by sector, a 3-hour threshold is typically accepted for critical infrastructure operators.

Section 4. Window 3, 3-6 Hours. Backup Verification, Triage, AD Compromise

In this window the urgent isolation is complete. Now the question is: can we move to recovery, or is there a deeper compromise?

4.1. 3-6 hour checklist

No. Action Owner Output
1 Backup integrity verification (hash + restore test in an isolated environment) Backup team Backup report
2 Scan for ransomware traces on backups (sleeper file check) Digital forensics Cleanliness confirmation
3 Disk image acquisition (sector level, with a write-blocker) Digital forensics Hashed disk image
4 Active Directory compromise analysis (KRBTGT, privileged group membership) DC administrator AD report
5 Detection of lateral movement tools (PsExec, WMI, PowerShell logs) SOC Lateral movement report
6 Hypothesis of the initial access vector (phishing, RDP, VPN, supply chain) Digital forensics Vector hypothesis
7 Expanding the IoC list (hash, IP, domain, registry, file path) SOC IoC dump
8 Finalizing the list of affected systems IT System inventory
9 Preliminary inventory of affected data categories Data inventory owner Data category draft
10 Preparing a "golden copy" in an isolated restore area IT Golden copy record

4.2. Backup verification flow

The fact that a backup can be restored does not mean the backup is clean. A common tactic of ransomware groups is to add a "sleeping" binary to backups weeks before the main attack, to restart after the restore. For this reason, backup verification must be two-staged.

  1. Restorability test. The backup is opened in an isolated sandbox and the file structure is checked.
  2. Cleanliness confirmation. IoC scanning and behavioral analysis on the restored environment.

Organizations that skip the second stage are exposed to a second wave after recovery.

4.3. Active Directory compromise checks

The following checks on Active Directory must be completed in this window.

  • Membership changes in the Domain Admins, Enterprise Admins, Schema Admins groups over the last 30 days
  • List of newly created accounts
  • Last password change date of the KRBTGT account
  • User accounts with a ServicePrincipalName added (Kerberoasting traces)
  • Abnormal changes on the AdminSDHolder ACL
  • Event log correlation for the possibility of a golden ticket

Section 5. Window 4, 6-12 Hours. KVKK Scope, Customer Message, Insurance

In this window the technical and legal outputs from the parallel tracks begin to merge. A customer communication draft is prepared, but not yet sent.

5.1. 6-12 hour checklist

No. Action Owner Output
1 KVKK 72-hour counter scope determination, which data categories were affected KVKK contact person Scope report
2 Estimate of the number of affected data subjects (a band range is acceptable) Data inventory owner Number estimate
3 Customer communication message draft (not yet published) Communications + Legal Draft awaiting approval
4 Internal message to be sent to employees (their tasks, expected behavior) HR + Communications Internal message
5 Formal call with the insurer, opening a claim file Finance + Legal Insurance case number
6 Assessment of the notification to be made to suppliers and business partners Legal Notification list
7 Decision on whether to respond to the attacker communication channel Senior management + Legal Decision note
8 Review of the "data breach" clauses in third-party contracts Legal Contract note
9 Legal unit's draft notification to the Board Legal + KVKK contact KVKK form draft
10 Senior management briefing second round, approval of the press strategy CISO + Communications Press strategy

5.2. Customer message draft note

In this window the message to be sent to the customer is not yet an "announcement." The following principles must be observed.

  • No undisclosed technical detail is given (the attacker group's name, IoCs, ransom amount)
  • Individual notification is prepared for customers confirmed to be affected
  • The message is not sent without passing the legal unit's approval
  • The internal spokesperson and external spokesperson must be a single person
  • The phrase "we have brought the incident under control" is not used if the situation is not certain

5.3. Coordination with the cyber insurer

Cyber insurance policies typically keep notification periods strict. Most policies require a preliminary notice to the insurer within 24-72 hours of learning of the incident. Failure to comply with the insurer's recommended panel firms (forensic, legal, communications) can reduce the compensation payment or lead to its rejection. For this reason these clauses of the policy must have been read and summarized before the incident.

Section 6. Window 5, 12-24 Hours. Restore, Legal Strategy, Ransom Payment Debate

In this window the technical recovery plan becomes clear, the legal strategy framework is drawn, and the ransom payment debate is addressed structurally.

6.1. 12-24 hour checklist

No. Action Owner Output
1 Ordering the restore plan by business criticality priority IT + Business units Restore schedule
2 Enhanced monitoring plan after recovery (14 days) SOC Monitoring plan
3 Structural assessment of the ransom payment debate Senior management + Legal Decision file
4 Group scan against OFAC and EU sanctions lists Legal + Compliance Scan report
5 Contact with law enforcement (if appropriate) Legal Correspondence record
6 Advanced draft of the KVKK notification form KVKK contact Pre-approval form
7 Internal communication second wave, employee briefing HR + Communications Communication record
8 Check whether the business continuity plan has been activated BCP owner BCP report
9 Customer call center briefing (how to answer questions) Customer Service Q&A document
10 First 24-hour lessons learned preliminary notes CISO Preliminary report

6.2. The ransom payment debate, the legal framework

The ransom payment decision is not only an ethical or financial decision, it is a decision with direct legal consequences.

US OFAC perspective: In its updated guidance published on 21 September 2021, the US Treasury Office of Foreign Assets Control stated that making ransomware payments to groups on the sanctions list constitutes a sanctions violation for US persons or entities connected to the US. Turkish companies carry risk if they do business with the US, use the US banking system, or have US-citizen executives.

EU perspective: EU sanctions lists (Council Regulation EU 269/2014 and its successors) apply asset freezes against certain persons and entities. If a ransom payment is a transfer going to these persons, a serious sanctions risk arises for companies doing business in the EU or employing EU citizens.

Turkey perspective: There is no direct prohibition on paying ransom in Turkish law, but a payment made to a terrorist organization or an entity on the sanctions list may create liability within the framework of MASAK and other relevant legislation.

The following questions must be answered in writing in the decision file.

  1. How long is the restore time if the ransom is not paid
  2. How reliable is the group's claim that it "destroyed" the exfiltrated data, even if payment is made for it
  3. Is the group on the OFAC or EU sanctions list
  4. Does the insurance policy cover the ransom payment, and what are its conditions
  5. What is the view of law enforcement
  6. Will the company's international business connections be exposed to sanctions because of the payment

Without answering these questions, a ransom payment decision may become the subject of management liability lawsuits in subsequent years.

6.3. When to call DSET

If any of the following situations exist, the line +90 536 662 38 09 is accessible 24/7.

  • The incident was noticed outside business hours or on the weekend
  • Your internal team's digital forensics experience is limited
  • There is special category data in the affected data category (health, biometric, criminal conviction)
  • Technical support is needed in the text of the KVKK 72-hour notification
  • There is a need for coordinated process management with USOM
  • There is doubt about backup integrity
  • The attacker group requires TLP:RED level threat hunting
  • There is suspicion of a supply chain impact

Section 7. First 24 Hours Combined Summary Table

The table below offers the opportunity to see the five windows on a single page.

Window Time Main goal Critical outputs
1 0-1 hour Isolation, volatile evidence RAM dump, network cutoff, chain of command
2 1-3 hours Start of the legal process USOM notification, insurance preliminary notice, DSET call
3 3-6 hours Scope and compromise Backup verification, AD analysis, IoC list
4 6-12 hours KVKK scope, communication preparation KVKK form draft, customer message draft
5 12-24 hours Restore and legal strategy Restore schedule, ransom payment file, KVKK form

Section 8. The Do-Not List

What should not be done in the first 24 hours.

  1. Rebooting the affected machine
  2. Attempting manual cleanup with antivirus (IoCs are lost)
  3. Early communication between the attacker and unauthorized persons
  4. A "there is no incident" statement on social media or in the press
  5. Giving an inadequately confirmed figure such as "it affected 100 customers" to minimize the number
  6. Opening a backup to production without scanning it
  7. Notifying the insurer after 24 hours have passed
  8. Pushing the start of the KVKK 72-hour counter to after the truth
  9. Publishing a customer announcement without obtaining the legal unit's approval
  10. Making the ransom payment decision without performing a sanctions list scan

Section 9. DSET Incident Response Retainer and Cross-Links

With over 20 years of cyber incident response and digital forensics experience, DSET is one of Turkey's leading independent expert teams. Our team at the Hacettepe University Teknokent Beytepe campus works with a chain of custody compliant with the ISO 27037 standard.

9.1. Retainer service scope

  1. 24/7 emergency line. Field team dispatch via the line +90 536 662 38 09.
  2. Remote and on-site digital forensics support.
  3. KVKK 72-hour and USOM 3-hour notification coordination.
  4. Backup integrity verification and golden copy restore architecture.
  5. Post-incident lessons learned and action tracking.

9.2. Related guides

The following DSET guides complement this page.

  • The KVKK 72-Hour Data Breach Notification Template guide works the breach notification process hour by hour.
  • The Cyber Incident Response Playbook NIST SP 800-61 Rev. 2 guide defines the four phases of the corporate IR structure.

For a meeting, you can write to [email protected] or call the line +90 536 662 38 09 directly. The first scoping meeting is free and is held under a confidentiality agreement.

Closing Note

In a ransomware incident, the first 24 hours determine the next 24 days, the 24 weeks, and the possible lawsuits to come. Adapting this guide to your internal runbook and putting it into practice with at least two tabletop exercises per year is the only guarantee that you can keep your composure during a real incident. Fast decisions are not made without preparation, and when fast decisions are not made, the value lost within 24 hours cannot be regained.