Encryption of your files, a note requesting payment in cryptocurrency, and a countdown timer: this is how attackers use ransomware to create panic, and panic is the most effective way to get what they want from you. The method of defence against these attacks is simple: isolate the area where the virus has infected your computer or network system, do not give in to demands for money, and allow a systematic recovery to go through all of the steps necessary to determine which data may be recovered without financing their next attack. Our bench runs that method for homes and businesses across Scotland.
Disconnect any machine that has been compromised by an infection from both your local network and the internet: ransomware will spread to every shared directory and drive that it is able to access, and network attached storage (NAS) units are particularly vulnerable. Do not wipe, do not clean up, do not re-install; the encrypted files, the ransom note and the malware itself are all essential evidence required for recovery. Do not pay: payment will fuel the industry, mark you as a "payer" and return working decryption far less reliably than the note promises. Report it: contact Police Scotland on 101 and report this type of incident to them; the National Cyber Security Centre (NCSC) takes incidents such as this very seriously. Get a quote first, by phone or using the form provided, and have all affected media sent to us, powered off, for assessment at the bench.
Real-life ransomware recovery can be a form of archaeological excavation as it involves multiple layers: known decryption tools for the specific type of ransomware that researchers have already cracked (it occurs more frequently than attackers will admit, and determining your specific strain is the initial step in the process); what was missed by the encryption itself (interrupted processes, overlooked directories and file types); shadow copies and snapshots of your system that are less likely to be removed by more careless versions of ransomware; the original deleted versions of files, because many ransomware strains encrypt a copy of a file, deleting your original (this portion of the recovery process becomes an element of a deletion recovery against the clock); and archaeological recovery of backups from drives you've since retired, or versions from cloud services that you may have forgotten existed. A truthful note: files encrypted using intact modern encryption methods, without a developed decryptor or any additional layer of recovery, will remain encrypted. You'll hear which parts of your data fall where at the free diagnostic.
Our strong advice is to say no. Payment for these ransoms is unreliable (decryptors that don't work properly, partial keys, and those who extort you more than once are all common), it also funds and encourages the next attack, and legal issues could arise depending on who is behind the strain. Let the assessment determine what is recovered without paying: often much more than panic suggests.
Often, and NAS boxes add extra layers: snapshots the strain may not have purged, and deleted-original recovery of data on volumes. Turn it off, do not factory reset it. Get a quote over the phone or with the form and send the disks labelled by bay if possible (or the whole NAS if you can't take them out). NAS-targeted strains now come to the bench regularly.
Yes. The first step in the process is to identify the strain via the ransomware note, its file extensions and samples, then check if there is a valid decryption tool available at this time. If there is a decryption tool available for use with the job, then it will be used; however, regardless of whether there is a decryption tool available or not, all other methods of data recovery can still be utilised. In either case, you will know prior to expending resources on recovering your files.