Ransomware Remediation Guideline
First-Responder Action Steps Before Engaging Professional Technical & Legal Help
⚠️ Immediate Triage Notice
If you have just discovered a ransom note on your computer or company network, DO NOT PANIC and DO NOT REBOOT YOUR COMPUTER. Follow the response flowchart below immediately to prevent network-wide propagation.
🔄 Emergency Incident Response Workflow
1. ISOLATE IMMEDIATELY
0–5 Mins
Unplug Ethernet cables & disable Wi-Fi/Airplane Mode. Unplug external storage & pause cloud sync. Keep PC powered ON to preserve RAM.
▼
2. DOCUMENT & EVIDENCE
5–15 Mins
Photograph the ransom screen with a phone camera. Note file extensions & record exact discovery time.
▼
3. IDENTIFY STRAIN
15–30 Mins
Use a separate clean phone/PC to check NoMoreRansom.org for existing free decryption tools.
▼
4. REGULATORY REPORTING & IR ENGAGEMENT
Within 72 Hours
Report to authorities if required by local regulations (e.g. PDPA mandates). Contact cyber insurance & professional DFIR teams.
Ransomware attacks in Singapore have increasingly targeted SMEs, professional services, and personal computers. Taking immediate, systematic containment steps within the first 15 minutes can drastically reduce loss of proprietary data, prevent compliance fines under Singapore's Personal Data Protection Act (PDPA), and retain volatile evidence required by forensic experts and insurance providers.
01. Immediate Containment (First 15 Minutes)
Step 1.1: Sever Network Connectivity Critical
Immediately disconnect the infected device from all network connections to prevent the malware from lateral movement across your Wi-Fi, Local Area Network (LAN), or cloud drives:
- Wired Connection: Unplug the Ethernet (LAN) cable directly from the machine.
- Wireless Connection: Disable Wi-Fi immediately or switch on Airplane Mode.
- Enterprise Switch: If multiple computers show ransom screens, disconnect the main network switch or router.
Step 1.2: Disconnect External Storage & Cloud Sync
Ransomware actively scans for attached storage to encrypt backups:
- Unplug all external hard drives, thumb drives, and NAS (Network Attached Storage) units.
- Pause or exit desktop sync tools for OneDrive, Google Drive, Dropbox, or Singtel Cloud to prevent encrypted files from syncing over clean cloud backups.
Step 1.3: Keep Devices Powered ON (Preserve RAM)
Unless you cannot disconnect network connectivity, do not shut down or restart the computer. Rebooting purges volatile RAM memory, which often contains active decryption keys, memory artifacts, and threat actor traces essential for forensic investigators.
02. Evidence Collection & Documentation
Before any cleanup attempt, build an evidence package. This is essential for filing reports with cyber authorities, law enforcement, and your cyber insurance providers.
- Photograph Screen Notes: Use a mobile phone to take clear photos of the ransom note on screen. Capture any contact email addresses, TOR website links, transaction IDs, and attacker signatures.
- Log File Extensions: Document the exact modified extension appended to encrypted files (e.g.,
.locked,.crypto,.phobos). - Record Timeline: Note down the exact date/time of discovery, who reported it, and any recent suspicious events (e.g., phishing emails opened, unusual system slowness).
03. Contact the Infinity Forensics Team
Once initial network isolation and triage are complete, engaging Digital Forensics and Incident Response (DFIR) specialists is critical to secure your infrastructure, isolate malware persistence, and restore operations safely.
How Infinity Forensics Assists Your Recovery:
- Rapid Threat Containment: Identify active command-and-control (C2) channels and eradicate backdoor persistence across your servers and endpoints.
- Volatile Memory & Root-Cause Analysis: Extract decryption keys or artifacts from preserved RAM and conduct deep malware reverse engineering to pinpoint initial entry vectors.
- Data Exfiltration Assessment: Analyze log files and forensic artifacts to determine if double-extortion tactics occurred (whether proprietary data was stolen prior to encryption).
- Safe System Remediation: Guide your team through secure network rebuilding, safe backup restoration, and environment hardening before going back live.
- Regulatory & Legal Liaison: Prepare formal Digital Forensic Investigation Reports suitable for regulatory submissions under PDPA mandates, law enforcement filings, and cyber insurance claims.
04. Crucial Mistakes to Avoid
| Forbidden Action | Why It Harms Your Recovery & Legal Standing |
|---|---|
| Paying the Ransom | Cybersecurity authorities strongly advise against paying ransom. Payment does not guarantee file recovery, funds criminal operations, and marks your entity as a paying target for future re-infection. |
| Deleting Encrypted Files | Encrypted files are not malicious code; they are scrambled data. Security vendors frequently publish free decrypters for known ransomware strains over time. Retain these files securely. |
| Running Generic Antivirus Tools | Running automated antivirus cleanup software can delete malware binaries, registry entries, and log files that forensic experts need to identify how the breach occurred. |
| Connecting Healthy Backups | Never plug an uninfected external backup drive into a system that hasn't been completely wiped and restored by a security professional. |
05. Free Decryption & Strain Identification
Pro-Tip: Check public decryption frameworks before paying for professional recovery services. Security researchers maintain free tools for hundreds of ransomware families.
Using a separate, uninfected computer or mobile phone:
- Visit NoMoreRansom.org (a global public-private partnership supported by Interpol).
- Upload a sample encrypted file along with the exact ransom note text.
- The portal will identify the ransomware variant and inform you if a free decryption tool exists.
06. Singapore Regulatory & Strategic Recommendations
📋 Recommended Action Channels
- National Cyber Incident Reporting: Submit an incident log through your local national CERT or cyber security agency portal to assist in wider threat tracking.
- Law Enforcement Reporting: File a cybercrime report via official police channels for formal investigation and insurance claims documentation.
- Data Protection Compliance: Under Singapore's Personal Data Protection Act (PDPA), verify whether compromised files contain personal data belonging to 500 or more individuals. If so, prepare to notify the Personal Data Protection Commission (PDPC) within 72 hours.
- Critical Infrastructure (CII): Entities operating designated Critical Information Infrastructure must comply with mandatory incident notification requirements under the Cyber Security Act.
- Cyber Insurance Engagement: If you hold an active policy, contact your insurance broker immediately. Insurers generally require engagement with their pre-approved panel of Digital Forensics and Incident Response (DFIR) specialists.