#14.1 Ransomware with Data Exfiltration

Playbook ID: PB-RANSOM | Default severity: SEV-1 (SEV-2 only when encryption is confined to one non-production segment and an immutable backup copy has been positively validated) | Owner: Incident Commander

#When to run this

Open this on: a ransom note or extortion email naming you; mass file-extension changes or a rename spike on a file server or hypervisor datastore; EDR detections for shadow-copy or backup destruction; your name on a leak site; backup jobs failing en masse or catalog entries vanishing; a hypervisor management plane locking out admins; or the actor contacting your executives, customers or a journalist.

Also open it on the quiet precursors, because by the time a note appears the decision window has closed: a helpdesk password reset or MFA re-enrolment you cannot attribute to the real employee, an infostealer hit on a corporate credential, or unexplained egress to cloud storage. Half of victims with previously leaked credentials were attacked within 95 days of the leak appearing (DBIR 2026).

Not for: payment fraud without encryption (14.2); a confirmed breach with no extortion demand (14.7); a compromise confined to the identity provider (14.4). Where initial access was an edge appliance or a Kubernetes cluster, run 14.12 or 14.10 in parallel — this playbook owns the extortion, that one owns the entry point.

#What you are dealing with

Ransomware and extortion appeared in 48% of confirmed breaches in the 2026 DBIR (SecurityWeek), and the brands rotate faster than your threat profile can: Q2 2026 leak-site claims hit 2,252 victims, with the top slot taken by a group that did not exist a year earlier (ReliaQuest). Build the response around behavior, not around a name.

Assume exfiltration happened first. Double extortion is the floor, not the differentiator — the live variable is whether they bother to encrypt. Coveware's payment rate for exfiltration-only cases fell to 15% (Coveware), while Sophos measured encryption success rising to 56% (Sophos). Both tracks are live, so triage must handle a case with no encrypted file anywhere and still call it SEV-1.

The change that should rewrite your playbook is what Mandiant calls recovery denial: operators now deliberately target backup infrastructure, identity services, virtualization management planes, AD CS certificate templates and hypervisor datastores — attacking your ability to recover, not just to operate (M-Trends 2026). Pair that with the entry path: 79% of ransomware attacks began with an identity-based approach, and 88% of encryption fired outside business hours (Sophos). Somebody logged in, walked to the backup console, and pressed delete at 3am on a Saturday. Nobody needed an exploit.

The mistake teams make is containing piecemeal. You find three encrypted hosts, isolate them, feel productive — and you have told the adversary you are awake while they still hold backdoors you never found. Mandiant's articulation is blunt: delay actions that directly disrupt the attacker until you can eradicate completely, then execute one remediation event (Aldridge, Black Hat 2012). Takeaway: plan the whole containment burst before firing any part of it. The one exception is live encryption — when files are being encrypted right now, isolate first and apologize to forensics later.

#Roles for this incident

Two markers in the tables. TIP-OFF — observable by the adversary; hold for the remediation event. EVIDENCE — degrades evidence; the preceding capture step must be complete first.

#Phase 1 — Detection and Triage

Export before you contain. Entra keeps sign-in and audit data for 7 days on Free, 30 on P1/P2 (Microsoft), holds are not retroactive, and no license upgrade recovers what already expired.

For 1.7 and 1.8, CISA names Snowflake, MEGA.NZ and S3 as DragonForce exfiltration destinations, and TeamViewer, Splashtop, AnyDesk, Tailscale and Ngrok as persistence tooling — while noting that their presence alone is not malicious (AA23-320A).

#Phase 2 — Containment

Three constraints shape this phase. MDE Isolate device auto-lifts after seven days, retries an offline device for only three, and can strand a proxied device — hence selective isolation in 2.4 (Microsoft). Changing an AWS security group does not terminate established connections, hence NACLs in 2.5 (AWS). And 2.7 stands apart from 2.6 because Microsoft states plainly that password resets and MFA are not effective against consented apps, which are external to your organization (Microsoft).

#Phase 3 — Eradication

krbtgt holds a two-password history, so one reset leaves the pre-incident key valid; CISA sets the interval at at least 10 hours so the first replicates (CM0050). And a certificate issued to an attacker survives every reset in 3.3 and 3.4 — which is why 3.6 is not optional.

#Phase 4 — Recovery

Identity first, in isolation, or nothing you restore afterwards can be trusted. Microsoft's forest recovery guidance is the authoritative sequence and requires the target DC not be connected to production (Microsoft).

The RID pool step in 4.4 is the one people cut for time. Skip it and principals created after recovery can be issued SIDs identical to pre-backup principals, inheriting their access rights — a permissions failure you will not find for months.

#Phase 5 — Post-Incident

Publication lags badly: one group ran an 11-month private extortion period before its leak-site debut (ReliaQuest). Six months of monitoring is a floor. And a finding without a re-test is a wish.

#Decision points

#Communications and notification triggers

Chapter 15 holds the full matrix. Two things are specific to this scenario: the payment starts its own clock, and the adversary is also communicating.

Personal data in the exfiltrated set starts the GDPR/UK GDPR 72-hour clock from awareness, plus the state, sector and contractual clocks in Chapter 15. SEC Item 1.05 runs from the materiality determination, not from discovery. Contractual clocks — BAAs, customer MSAs, insurance notice — are usually the ones you actually miss.

Give accurate impact information, avoid hyperbole, and avoid anything you may have to retract; "no known impact on personal data" is the sentence that ages badly (NCSC). Staff see external statements before the public does. And expect the adversary to keep talking: triple extortion adds DDoS, outreach to your customers and journalists, and regulatory weaponization — one group filed an SEC complaint against its own victim for failing to disclose the breach that group had caused. Draft the holding statement before you need it.

#Automation notes

Automate where the action gathers rather than changes: evidence collection, enrichment, correlation, timeline assembly. Step 1.3 is the strongest candidate here — a log export racing a 7-day retention window is a race a human loses at 3am, and it is entirely reversible.

Gate everything whose blast radius scales with a false positive. Auto-isolating one workstation is defensible with a pre-agreed critical-asset exclusion list; auto-isolating a domain controller, hypervisor host or backup server is not. Quarantine SCPs, OIDC provider deletion and enterprise password resets are approval-gated by construction.

The rule: automation may gather, enrich, correlate and recommend without approval; it may act only where the action is reversible, scoped and rate-limited; anything irreversible or organization-wide needs a named human approver, and every automated action carries the evidence that justified it. The two documented AI-triage failure modes are overconfident closure on weak proof and hallucinated detail in investigation narratives. In a timeline a regulator will read, an invented detail is worse than a gap.

#Pitfalls