How should a server be recovered after ransomware?
Recovery starts with containment and understanding the compromise, not immediately restoring the newest copy. A recovery point can contain malicious persistence or damaged data if the attacker was already present. Coordinate the response with the designated incident owner and trusted security specialists.
Before you start
- An incident coordinator, trusted communication route and authorised recovery team.
Instructions
1. Contain and preserve relevant evidence
Identify affected servers and accounts, restrict the confirmed malicious paths and record actions and timestamps. Coordinate isolation to avoid unnecessary impact on unrelated services. Preserve available logs and evidence using the approved response process; use a trusted device for incident communications and credential administration.
2. Establish a trusted recovery base
Determine the likely compromise window and the systems or credentials used for persistence. Rebuild affected environments from trusted sources where appropriate, address the entry point and replace exposed credentials through the coordinated plan. Do not return a restored system to the same uncontrolled environment.
3. Validate data before reconnecting
Select a suitable existing recovery point and test it in an isolated environment. Check application consistency, security controls and signs of compromise, then restore service in the agreed order. Monitor closely after reconnection and have the incident owner determine when recovery acceptance criteria are met.
Check the result
- The entry path and affected credentials have been addressed before normal access resumes.
- The restored application passes business and security checks using an approved recovery point.
Troubleshooting
- Encryption or suspicious access returns after a restore
- Re-isolate the affected service and investigate persistence, compromised credentials or another infected dependency. Repeating the same restore without addressing the cause can repeat the compromise.
Official references
Use the documentation for your installed version when a flag, service name or platform feature differs.