Ransomware Recovery
Rapid restoration of critical systems and data after encryption, with forensic preservation running in parallel so recovery never destroys the evidence you will need later.
What you receive
- Triage of encrypted estate and recovery sequencing
- Forensic preservation before restoration begins
- Threat-actor assessment and negotiation support
- Root-cause analysis and reinfection prevention
When you need this
Three situations that call for it. If none of them is yours, it probably is not the right spend.
Your backups exist and you cannot trust them
The backup repository was domain-joined and the service account was reused, so the restore may hand back the intruder's access along with the data. Recovery sequencing exists to stop you reinfecting the estate on day two.
Production is down and finance wants to pay
The payment question is legal and commercial before it is technical, and it is usually asked before anyone has modelled how long recovery without payment would take. That model, and the sanctions position, should exist before the board votes.
Encryption was the last step, not the first
Actors typically spend days inside and take the data out before anything is encrypted, so restoring the files answers only half the problem. What left the building determines the second demand and every notification you owe.
How it runs
Scoping call
Thirty minutes with an engineer, not a sales development rep. We establish what you actually need and tell you plainly if it is not us.
Written proposal
Fixed scope, fixed price, named delivery team, and the rules of engagement in writing before anyone touches a system.
Delivery
Weekly written status and a direct channel to the delivery lead. Critical findings are escalated the moment they are confirmed, never held back for the report.
Readout and retest
A working session with your team, an executive summary for your board, and a remediation retest included in the original scope rather than quoted separately.
No lock-in
Scoping costs nothing and carries no obligation. If the answer is that you do not need this, that is a legitimate outcome of the call.
Who turns up
The engineer on your scoping call is on the delivery team. We do not hand you to a different group after signature.
Scope
What this does not cover
We do not pay ransoms or hold cryptocurrency on your behalf — we assess the actor, model the alternative, and the decision stays yours.
We sequence and verify restoration; we do not supply hardware, licences or the infrastructure team that rebuilds a destroyed estate.
Evidence handling beyond preservation belongs to Digital Forensics — here, preservation exists so that option is still open later.
- NIS2 Directive (EU) 2022/2555, Art. 21(2)(c)
- Business continuity measures are named explicitly, including backup management, disaster recovery and crisis management.
- OFAC Ransomware Sanctions Advisory (2021)
- Facilitating a payment to a sanctioned actor risks US civil liability on a strict-liability basis, whoever moves the funds, updated 21 September 2021.
If the scope is wrong
Tell us on the call. Re-scoping before we start costs nothing; discovering it at the readout costs you the engagement.
Questions
The ones we are actually asked.
Will you tell us whether to pay?
We will not make that decision for you. We can say what this actor's decryptor usually does, what recovery without payment would cost in days, and where sanctions exposure may sit — the decision belongs to the board.
Is there a decryptor for our variant?
Sometimes, and it is the first thing to check — a leaked key or a flawed implementation makes the question moot. Most of the time there is not, and anyone answering before the variant is identified is guessing.
Can you get the stolen data taken down?
Nobody can guarantee removal from a leak site, and payment does not delete copies that already exist. We can establish what was taken and prepare notifications written on the assumption it stays published.
See what an attacker sees
We map your external attack surface the way an adversary does — exposed assets, leaked credentials, impersonation domains. No agent, no access, no cost.
30 min
A scoping call, with an engineer rather than a sales rep.
What it costs
Nothing, and there is no sequence afterwards. If we are not the right fit we will say so and suggest who is.
Under attack now?
Do not use this form. The hotline is answered around the clock and reaches a duty analyst directly.