The First 24 Hours After a Ransomware Attack: An Emergency Response Guide

TL;DR: On a ransomware-infected system, the first hours determine everything. The correct order: keep the device in place, disconnect it from the network, photograph the screen, isolate the backups, notify USOM within 3 hours, and notify KVKK within 72 hours. The NIST SP 800-61 incident response framework and the ISO 27037 chain-of-custody methodology should guide you. If you have a backup, restore plus run a parallel forensic analysis. If you have no backup, search for a decryptor through No More Ransom, then bring in a professional data recovery team. Not paying the ransom is the recommendation of CISA and the FBI IC3.

Ransomware cases are on the rise across Turkey. For a detailed picture, see the Turkey Cyber Threat Landscape 2026 pillar article. This guide explains, hour by hour, what you need to do in the first 24 hours from the moment you encounter a ransom note.

The First 5 Minutes: Controlling the Panic

A red background on your screen, a skull icon, the words "your files are encrypted." Your reflex will be to pull the plug. Do not.

  1. Take your hands off the device. Do not touch the keyboard, do not move the mouse, do not close the open file.
  2. Photograph the screen with your phone. The ransom note, the wallet address, the contact email, the countdown timer, and the file extension pattern. These are worth their weight in gold for identifying the attacker group.
  3. Disconnect the machines next to it from the network. Turn off Wi-Fi, pull the Ethernet cable. Through lateral movement, ransomware can encrypt the entire domain within minutes.
  4. Immediately isolate the backup server. Attackers usually look for the backups first and delete them. If there is a backup network segment, cut the link.
  5. Notify the IT administrator verbally. The email system may also be affected; use the phone. Order users to "not touch any device."

The First Hour: Preserving the Evidence

The most critical window from a digital forensics standpoint has now opened. The NIST SP 800-61 Containment phase must be run in parallel with the Identification phase. The ISO 27037 standard is the international reference for the identification, collection, and preservation of digital evidence.

What to do at this stage:

  • Keep the device powered on. RAM contents are volatile memory and vanish when you power off. If a shutdown is performed without a RAM dump (memory image), the encryption key, the process list, and the network connections are lost permanently.
  • Copy the text of the ransom note into a separate text file. Save the note to a USB drive or a clean device. You will need its contents to upload to the No More Ransom Crypto Sheriff tool.
  • Take two samples from the encrypted files. A small file (for example 1 MB) and a large file (over 10 MB), for decryptor analysis.
  • Keep a written record of the time of the incident. What time it is, who noticed it, what the first symptom was. A chronology is essential for the insurance claim and the KVKK notification.
  • Protect the log servers. Stop the cyclic overwriting of logs from the Domain Controller, firewall, EDR, and SIEM. The attack vector emerges from here.

The "Ransomware Response Checklist" on the CISA Stop Ransomware page summarizes these steps on a single page, and it is recommended that you print it out and keep it ready at the office.

The "Do Not Do" List

Wrong decisions made in a moment of panic cannot be undone later. Five critical prohibitions:

  1. Do not restart the device. Some ransomware families trigger second-stage encryption at the moment of a reboot. The key in RAM vanishes.
  2. Do not start a full antivirus scan. An AV scan can delete or quarantine the evidence's signatures, file timestamps, and potentially the encrypted files.
  3. Do not delete the encrypted files. If a decryptor is released, they can be recovered. A chance for partial recovery via Volume Shadow Copy may also remain.
  4. Do not reply on the channel in the ransom note. Communicating with the attacker, without a negotiation specialist, does harm. It can reduce the time remaining and prompt additional demands.
  5. Do not pay. We explain the details below; in short, the joint recommendation of the FBI and CISA is not to pay.

Hours 1 to 3: Isolation and Scope Assessment

Within these three hours, you should have found the answers to the following questions:

  • How many machines were affected? The distinction between workstation, server, virtual, and physical.
  • Which data sets are encrypted? File server, email, database, ERP.
  • The total volume of affected data (in TB).
  • A hypothesis on the attack vector: a phishing attachment, open RDP, a VPN exploit, a supply-chain compromise.
  • Was Active Directory affected? Was Domain Admin compromised?
  • Is the attacker still inside? Is there beacon traffic?

ENISA annual ransomware threat reports provide a sector reference for scope assessment at this stage. The ENISA Threat Landscape report contains the list of TTPs (tactics, techniques, procedures) observed across Europe and offers statistics on which group prefers which vector.

USOM Notification: The 3-Hour Window

In Turkey, critical infrastructure operators have an obligation to notify USOM (the National Cyber Incident Response Center). The critical infrastructure sectors are:

  • Electric power
  • Natural gas
  • Water management
  • Banking and finance
  • Electronic communications
  • Transportation
  • Critical public services
  • Healthcare

The notification form is completed through the USOM portal. The notification hotline phone number and email address are also published on the portal for emergencies. Failure to notify results in an administrative fine in BTK audits. Even though notification is not mandatory for organizations outside critical infrastructure, notifying USOM is strongly recommended in order to receive coordination support.

KVKK Notification: 72 Hours

KVKK, the Personal Data Protection Authority, requires notification within 72 hours when a data breach occurs. Ransomware is, in nearly every case, a data breach, because in modern attacks the data is first exfiltrated and then encrypted.

The 72-hour clock starts from the moment the breach is "learned of." The "moment of learning" is the moment reasonable suspicion arises; definitive confirmation is not awaited. If the scope is uncertain, a two-stage notification is possible:

  1. Preliminary notification: That a breach has occurred and that the scope investigation is ongoing.
  2. Supplementary notification: The details finalized after forensic analysis.

The notification form is completed through the "Data Breach Notification System" on the KVKK web portal. An obligation to notify the relevant individuals (the affected data subjects) may also arise.

The chain of custody is very important in the KVKK breach notification process. If the forensic report will go to court, the digital forensics examination process must have been hash-verified, worked on through an image, and conducted with a write blocker.

Hours 3 to 12: Triage and Recovery Planning

Three parallel streams run within this window:

Backup assessment. Is there an unaffected, immutable (write-once) backup? What is the date of the backups' last successful state? Has the Volume Shadow Copy been deleted (the vssadmin delete shadows command is a standard move of modern ransomware)? Did the cloud-replicated backups also get infected (cryptolocker, in some cases, spreads via sync through OneDrive/Dropbox)?

Family identification. The family is determined by the file extension (such as .lockbit, .conti, .blackcat/.akira, .play, .royal, .8base) and by uploading the ransom note to ID-Ransomware or the No More Ransom Crypto Sheriff. Once the family is known, you check whether a decryptor exists, whether the group is on the OFAC sanctions list, and its TTPs.

Choosing the recovery scenario. There are three paths:

  • Restore from an air-gapped clean backup.
  • A solution over the encrypted data if a decryptor exists.
  • If there is no backup and no decryptor, a data recovery specialist plus a negotiation assessment.

The Decision Not to Pay: The Reasons

The joint statement of the FBI IC3 and CISA is clear: paying the ransom is not recommended. The reasons:

  • Payment does not guarantee the return of the data. Cases have been documented where, even after the key was sent, it did not work or was corrupted. Some groups take the money and cut off communication.
  • Double extortion continues. Even if you pay, the exfiltrated data can be uploaded to a leak site or sold to another group.
  • Funding the same group. When a victim pays, money enters the group's ecosystem and the scale of subsequent attacks grows.
  • There is no KVKK defense. "We paid the ransom and recovered the data" is not a valid defense in the KVKK breach process. The breach must still be reported.
  • OFAC sanctions risk. Some ransomware groups (the successors of Conti, groups linked to Evil Corp) are on the U.S. OFAC list. Paying or facilitating a payment to these groups may be a legal violation for U.S.-linked organizations.

Hours 12 to 24: Forensics and Recovery in Parallel

In this final window, two separate teams work at the same time:

The digital forensics team: takes a bit-for-bit image of the affected machines. A disk image through a write blocker, hash verification (SHA-256), and a timestamped report. Searching for the encryption key in the RAM dump. Building the attack timeline: initial access, lateral movement, persistence, exfiltration, encryption.

The IR (incident response) team: brings the system back up in a clean environment. Restoring from an air-gapped backup. Resetting the Active Directory tier-0 (a double krbtgt reset). Changing all passwords. Activating MFA. Rolling out EDR. Closing the attack vector (for example, closing open RDP, applying missing patches, enforcing MFA on an exposed VPN endpoint).

While the two teams work at the same time, to avoid breaking the chain of custody, the forensics team should take the images and the IR team should intervene not on the original systems but on the restored environment.

What Does "Double Extortion" Mean?

Modern ransomware operations (Big Game Hunting) are two-stage:

  1. Exfiltration: The attacker infiltrates the network, stays inside for weeks (sometimes months), and copies sensitive data out. Mega.nz, AnonFiles, and the attacker's own C2 servers are used.
  2. Encryption: Once it is confirmed that the data is outside, encryption is triggered. The ransom note demands both a decryptor fee and a "do not publish the data" fee.

In a double-extortion scenario, even if you restore from backup, the data leak has already occurred. KVKK breach notification is mandatory. If publication occurs on a data leak site (for example, LockBit's historical data-disclosure pages, or the thousands of organizations Cl0p published in the 2023 MOVEit campaign), additional reputational damage results.

Families With an Available Decryptor

The No More Ransom Project is a free decryptor database published in partnership between Europol and the private sector. As of 2026, the families that stand out among those with an available decryptor include:

  • STOP/Djvu (variants encrypted with an offline ID)
  • GandCrab v1 to v5 (in partnership with Bitdefender)
  • Maze (leaked keys)
  • REvil/Sodinokibi (the FBI released the master key in 2022)
  • Lockfile, Babuk (families whose source code was leaked)
  • HermeticRansom

An encrypted file sample and the ransom note are uploaded to the Crypto Sheriff tool, and the system attempts to identify the family.

The Chance of Data Recovery When There Is No Backup

If there is no backup and no decryptor, hope is not entirely lost. Alternative paths:

  • Volume Shadow Copy: If the ransomware did not delete it with vssadmin, partial recovery from system restore points.
  • Previous file versions: Windows File History, macOS Time Machine local snapshots.
  • Data-bearing blocks via a clone image: File carving techniques on a forensic disk image.
  • Database transaction log replay: Partial recovery from transaction logs in systems such as SQL Server, PostgreSQL, and MySQL.

The detailed process for these options is explained in the data recovery article. A combined digital forensics plus data recovery approach is important, because if the recovered data is to carry evidentiary value in court, the chain of custody must be preserved.

The Insurance File

If you have cyber insurance, read the policy:

  • Is ransomware within scope?
  • Is the ransom payment covered by the insurer? (Since 2023, many policies have excluded this item.)
  • Is there an "act of war" exclusion? (State-sponsored attacks are excluded from scope in some policies.)
  • What is the notification period? (Generally 24 to 72 hours.)
  • Is there an approved IR provider list? (The insurer may require teams from its own panel.)

Global Reference Cases

Publicly known cases that serve as guidance in initial response:

  • Colonial Pipeline (2021): A U.S. fuel pipeline, the DarkSide group, 5 days of operational outage; the FBI later recovered a portion of the cryptocurrency paid. The case report is available in the CISA archive.
  • MOVEit (2023): The Cl0p group, a SQL injection vulnerability in MOVEit Transfer, thousands of organizations affected, an exfiltration-plus-extortion scenario rather than classic encryption.
  • JBS Foods (2021): The world's largest meat processor, REvil, a production halt.
  • Irish HSE (2021): The Irish health system, Conti, hospital operations disrupted for weeks.

The common takeaway from these cases: the decisions made in the first 24 hours (what was paid, what was reported, what was shared) determined the loss tally of the months that followed.

The Next 30 Days: Post-Incident

The improvement cycle that begins after the first 24 hours:

  • Penetration testing and red team simulation.
  • A root cause analysis (RCA) report.
  • Resetting Active Directory and the identity infrastructure.
  • An MDR (Managed Detection and Response) or 24/7 SOC subscription.
  • Employee awareness training (especially phishing simulations).
  • Reviewing the backup strategy (the 3-2-1-1-0 rule: 3 copies, 2 different media, 1 offsite, 1 offline, 0 unverified restores).
  • Revising the IR playbook.

FAQ

If I pay the ransom, will the data come back?

There is no guarantee. In FBI case statistics, a significant portion of organizations that paid either received a non-working key, recovered only part of the data, or got no response at all. In a double-extortion scenario, the disclosure of the data may also continue separately.

Do I have an obligation to notify USOM?

If you fall within critical infrastructure (energy, finance, telecom, healthcare, transportation, water, critical public services), yes, it is mandatory. In other sectors it is voluntary but recommended, because you gain access to coordination and TTP intelligence sharing.

What happens if I do not report a KVKK breach?

Violating the notification obligation results in an administrative fine. In addition, the affected individuals' right to file a compensation claim is reserved. The KVKK Authority's regularly published data breach notification page shows which companies were fined and how.

Should I delete or keep the encrypted files?

Keep them. Sometimes a decryptor is released months later. The No More Ransom database is updated continuously. Moving the encrypted files to cold storage (an external disk, offline) is reasonable.

Does my insurance cover ransomware?

It depends on the policy. Since 2023, many insurers have begun excluding the ransom-payment item, but they continue to cover IR costs, business interruption losses, legal counsel, and the risk of a KVKK fine. The policy wording is critical.

What can I do if the backup was also encrypted?

Cloud replication (if there is a pre-infection snapshot), previous backup rotations, an immutable storage option (if any). Otherwise, partial recovery through a decryptor plus data recovery.

How do I find out whether a decryptor exists?

Upload an encrypted file sample plus the ransom note to the No More Ransom Crypto Sheriff tool. The ID-Ransomware service is an alternative. Once the family is identified, you can download a decryptor if one exists.

Working With DSET

DSET (Doganay Cyber Security Technologies), based at Hacettepe Teknokent in Ankara, operates a 24/7 emergency response line for ransomware cases. The scope of service:

  • Starting remote triage within the first hour.
  • Forensic imaging (write blocker, hash verification, ISO 27037 compliant).
  • USOM and KVKK notification consulting.
  • No More Ransom decryptor analysis.
  • Data recovery laboratory support when there is no backup.
  • Post-incident hardening over the following 30 days.

Pillar article: Turkey Cyber Threat Landscape 2026. Related cluster: digital forensics examination, data recovery.

Emergency response line: +90 536 662 38 09 Address: Hacettepe Teknokent, Ankara

Sources: USOM, KVKK, CISA Stop Ransomware, No More Ransom, ENISA Ransomware, NIST SP 800-61, FBI IC3.