Introduction
Ransomware is the threat that has brought the most companies to a standstill over the last decade. It is not just about encrypting files: modern operators steal data before encrypting it, threaten to publish it, and seek to destroy accessible backups to force payment. A medium-sized company can lose days or weeks of operations, and the average cost of an incident in Mexico far exceeds the ransom demanded.
The difference between a company that recovers in hours and one that shuts down for weeks is not luck: it is having an incident response plan, validated backups, and a team that knows what to do under pressure. In this article, we detail, step by step, how to respond to a ransomware attack from detection to full restoration.
The first 24 hours are decisive
When ransomware is detected, the natural instinct is to panic or try to negotiate. Both reactions worsen the outcome. The first 24 hours define the extent of the damage, the speed of recovery, and the company's legal exposure. Every minute without containment allows the attack to spread to more systems and reach backups.
That is why the response must follow a structured protocol, not an improvised one. At HB Systems, we apply a five-phase model that has enabled Mexican companies to recover from real incidents without paying a ransom and without losing critical information.
Phase 1: Immediate containment
The goal of this phase is to stop the spread. It is not about cleaning up or restoring yet: it is about isolating the attack before it reaches more systems and, above all, before it touches backups.
1.1 Isolate affected systems
Disconnect compromised computers and servers from the network without shutting them down unless strictly necessary. Shutting down can destroy evidence in memory that is useful for forensic investigation.
1.2 Protect backups
Immediately verify that backups are safe. If backups are accessible from the production network, isolate or disconnect them. A backup the attacker can reach is a lost backup.
1.3 Disable compromised accounts
Revoke credentials and active sessions for privileged accounts the attacker may have compromised. Change passwords for administrators and service accounts.
1.4 Segment the network
Block lateral movement between VLANs, segments, and branches. Ransomware spreads through stolen credentials, not just technical vulnerabilities; limiting movement reduces its reach.
This phase does not last hours: it lasts minutes. That is why it is vital to have a documented and rehearsed playbook before the incident, not during it.
Phase 2: Damage assessment
Once the attack is contained, its actual scope is assessed. This phase determines what was lost, what can be recovered, and how long it will take to resume operations.
- Inventory of affected systems: which servers, computers, and services were encrypted or exfiltrated.
- Identification of the entry vector: phishing, exposed VPN, open RDP, unpatched vulnerability, leaked credential.
- Exfiltration assessment: determine whether the attacker stole data before encrypting it, triggering notification obligations.
- Backup verification: confirm which copies are intact, which are immutable, and what the most recent viable recovery point is.
- Target RTO calculation: estimate how long it will take to restore each critical system.
At HB Systems, we use forensic analysis tools to reconstruct the attack timeline, identify the entry point, and document everything for legal and insurance purposes. This documentation is essential if the company decides to report the incident or file a claim under a cyber insurance policy.
Phase 3: Threat eradication
Restoring onto a system that still contains the threat is a common mistake that leads to a second attack within days. Before rebuilding, every trace of the attacker must be eliminated.
Eradication is not about guessing where the attacker was: it is about confirming, with evidence, that they no longer have access. That is why this phase is combined with intensive monitoring during the first weeks after recovery.
Phase 4: Restoration from clean backups
This is the phase where a well-designed backup strategy proves its value. If backups are immutable, isolated, and periodically validated, restoration can be measured in hours, not days.
Select the recovery point
Choose the most recent copy known to be clean, verifying that it contains no malware and was not touched by the attacker. Prefer immutable or air-gapped copies.
Restore by priority
Recover business-critical systems first: ERP, transactional databases, authentication. Then, secondary services and workstations.
Validate before reconnecting
Every restored system must pass an integrity check and a security scan before returning to production. Restoring without validation reintroduces risk.
Document the actual RTO
Measure how long recovery actually took against the defined target. This figure informs the continuity plan and future investment decisions.
If backups do not exist, are corrupted, or were encrypted, the only option is to rebuild from scratch or negotiate, and the latter never guarantees data recovery. This underscores the importance of having invested in a 3-2-1-1-0 strategy before the incident.
Phase 5: Post-incident and lessons learned
Recovery does not end when systems resume operation. The post-incident phase is where a company transforms a crisis into future resilience. Essential actions are:
- Intensive monitoring for at least 30 days to detect attempts by the attacker to regain access.
- Complete incident documentation: timeline, vector, scope, actions taken, and timing.
- Response plan review: what worked, what failed, and what must be improved before the next event.
- Communication with stakeholders: customers, authorities, and insurers according to the scope and legal obligations.
- Investment in addressing identified gaps: immutable backups, segmentation, MFA, training, and monitoring.
How to prevent the next attack
No company is immune to ransomware, but those that recover quickly without paying a ransom share a prevention pattern built on five pillars:
Immutable, isolated backups
At least one air-gapped or immutable copy that the attacker cannot modify or delete. It is the difference between recovering in hours and shutting down for weeks.
Zero Trust and MFA
Multifactor authentication for all remote and administrative access. Network segmentation that limits the attacker's lateral movement.
Patching and vulnerability management
Proactive remediation of known vulnerabilities, especially in VPN, RDP, and internet-facing services. The attacker enters through the easiest open door.
Rehearsed response plan
A playbook the team knows and has practiced in drills. The pressure of a real incident is no time to learn the plan.
Training and awareness
Phishing remains the most common vector. Training staff to detect and report attempts turns every employee into a security sensor.
At HB Systems, we help Mexican companies implement these pillars before an incident occurs, because the question is not whether an attack will come, but whether the company will be prepared when it does.
Conclusion
Ransomware recovery is a five-phase process—containment, assessment, eradication, restoration, and post-incident—that only works with advance preparation. There is no room for improvisation when systems are encrypted and every minute counts.
At HB Systems, we support companies in Mexico through both stages: designing the resilience architecture that prevents disaster and providing technical response once an incident has occurred. If you want to assess your ransomware preparedness or need support with an active incident, the first step is a no-obligation conversation.