Incident Response for Ransomware, APT Intrusions, and Cyber Attacks

The Problem: The First Hours Determine the Outcome

When a cyber attack begins, the clock does not start at the moment you notice it. It started the moment the attacker first gained access — potentially days, weeks, or months earlier. By the time an alert fires, or an employee reports unusual behaviour, or your file shares are suddenly displaying ransom notes, the attacker has likely already completed most of their mission. The first hours of your response do not determine whether you were breached. They determine whether the breach becomes a manageable, contained incident or a cascading catastrophe.

Most organisations underestimate how quickly the situation can deteriorate. A ransomware operator who establishes access on a Monday will typically conduct reconnaissance, identify backup locations, disable security tooling, exfiltrate sensitive data, and deploy the encryption payload within 72 hours — sometimes within hours if they are operating under time pressure. An incident response team that engages four hours into that window is in a fundamentally different position than one that engages eight or twelve hours in.

The second problem is evidence. The volatile memory of a compromised system contains running processes, network connections, encryption keys, and attacker tooling that disappear permanently the moment the system is rebooted. When a panicked IT team's first instinct is to shut everything down and restore from backup, they are making the attacker's job easier — eliminating the forensic record that would allow attribution, insurance recovery, and potentially law enforcement action. This mistake is extraordinarily common, and it is entirely avoidable with experienced guidance in those first critical minutes.

The third problem is that most organisations have no pre-existing relationship with an IR provider when an incident occurs. Every minute of the first hour is spent on NDAs, contracting, and procurement rather than on investigating and containing the attack. A retainer arrangement eliminates this friction entirely.

Our Approach: Triage, Contain, Eradicate, Recover

AmonSul incident response follows a disciplined, evidence-preserving methodology that simultaneously addresses the immediate crisis and builds the forensic record needed for attribution, legal proceedings, and insurance recovery.

Triage begins the moment you engage our on-call analyst, 24 hours a day, 7 days a week, 365 days a year. Within 15 minutes of the call, your analyst will establish a secure incident command channel, begin remote access to affected systems, and issue immediate guidance on what to isolate and what to preserve. The objective of triage is to understand the scope of the incident and prevent further spread while preserving forensic integrity.

Forensic acquisition runs in parallel with triage. We collect volatile memory dumps from affected systems, acquire disk images with write-protected forensic hardware where required, capture network traffic, and preserve all relevant log data before any remediation activity begins. This evidence is processed through our forensic pipeline and documented with full chain of custody for legal and regulatory purposes.

Containment is proportionate to the threat. For ransomware incidents, we isolate encrypted systems while preserving clean backups, identify the patient-zero system, and block attacker infrastructure at the network perimeter. For APT intrusions, we pursue stealthy containment — removing attacker access without alerting them that they have been detected, to allow full intelligence collection before eradication.

Eradication systematically removes all attacker presence from your environment: malware, persistence mechanisms, backdoors, compromised credentials, and rogue accounts. We do not declare eradication complete until we have searched for all known persistence techniques used by the specific threat actor involved.

Recovery restores business operations from verified clean backups, with additional monitoring in place to detect any recurrence. We remain engaged through the recovery phase to confirm the environment is clean before standing down.

What You Receive

During the incident: a dedicated incident channel with your named AmonSul analyst, real-time situation reports as the investigation progresses, clear executive briefings suitable for board communication and regulatory notification, and continuous guidance for your IT team on what actions to take and what to avoid.

The post-incident report: a complete forensic timeline from initial compromise to containment, root-cause analysis, attacker attribution where evidence permits, a full inventory of systems and data affected, and a forensic evidence appendix formatted for regulatory submission, insurance claims, and law enforcement referral.

The hardening playbook: a prioritised list of the specific control failures the attacker exploited, with implementation guidance and effort estimates for each remediation. This is not a generic security checklist — it is specific to the vulnerabilities and misconfigurations identified in your incident.

Regulatory notification support: draft notifications for NIS2 Article 23, GDPR data-breach notification, and relevant national regulators, formatted to the required standards and reviewed by our legal partners.

Why AmonSul

Incident response quality is almost entirely a function of experience. An analyst who has handled twenty ransomware cases knows which decryptors work against which ransomware families, which threat actors tend to leave backdoors in specific locations, and how to distinguish genuine attacker activity from benign administrative noise. That knowledge is built over hundreds of real engagements, not over training exercises.

AmonSul's IR team has responded to ransomware, APT intrusions, destructive wiper attacks, and insider-threat cases in the specific environment our clients face — defence tech and critical infrastructure targeted by sophisticated, well-resourced adversaries. Several of our analysts operated during active Russian cyberattacks against Ukrainian infrastructure, responding to real incidents under conditions that no commercial IR training programme can replicate.

We have also built direct working relationships with CERT-UA, the National Police of Ukraine's Cyber Division, and Europol's EC3, which means our incident investigations can connect into law enforcement and attribution networks that are not accessible to most private IR providers.

---

If you are in an active incident right now, call our 24/7 hotline. If you want to be prepared before one occurs, talk to us about a retainer — the onboarding takes a single half-day session.