<h2>The Clock Starts at Detection</h2><p>Ransomware incidents are uniquely time-sensitive. Unlike a data breach where the attacker may have been dormant for weeks, ransomware announces itself loudly — and the damage compounds with every minute encryption continues to spread.</p><p>Your first 60 minutes will determine whether this is a contained incident or a catastrophic business disruption.</p><h2>Minute 0–5: Confirm and Classify</h2><p>Before doing anything else, confirm you are dealing with ransomware and not a false positive or a different malware family. Look for:</p><ul><li>Ransom note files (README.txt, DECRYPT_FILES.html, etc.)</li><li>Mass file extension changes (.locked, .encrypted, .WNCRY, etc.)</li><li>Rapid disk I/O spikes across multiple endpoints</li><li>Shadow copy deletion commands in process logs</li></ul><p>Classify the severity immediately: Is this a single endpoint, a department, or the entire estate? Is your backup infrastructure affected?</p><h2>Minute 5–15: Isolate, Do Not Shut Down</h2><p>The instinct to power off affected machines is understandable but wrong. Shutdown destroys volatile memory — which may contain encryption keys, C2 communication artefacts, and attacker tooling that is critical for forensic investigation and potential decryption.</p><p>Instead, network-isolate affected endpoints via your EDR platform's kill-switch or by disabling their network interfaces. Keep them powered on for memory acquisition.</p><h2>Minute 15–30: Protect Your Backups</h2><p>Ransomware operators specifically target backup infrastructure. Before anything else, verify your backup systems are intact and isolate them from the network. If your backups are cloud-connected, revoke the credentials used to access them immediately.</p><h2>Minute 30–60: Forensic Preservation</h2><p>Acquire volatile memory from patient-zero endpoints using tools like WinPmem or Magnet RAM Capture. This single action can make the difference between a full recovery and paying a ransom — memory dumps frequently contain decryption keys for ransomware families that use in-memory key storage.</p><p>Preserve all logs: Windows Event Logs, EDR telemetry, firewall logs, and DNS query logs. These will reconstruct the attacker's dwell time and lateral movement path.</p><h2>After the First Hour</h2><p>Once immediate containment is achieved, the investigation phase begins. SpiderIQ's DF&IR team operates a 34-step ransomware response playbook covering identification, forensic investigation, eradication, and post-incident hardening — available to all DF&IR portal clients.</p>