Ransomware recovery starts with isolating the affected systems, then removing the attacker’s access, then restoring clean systems and data from offline backups. Detection comes first: the early signs are many files being rewritten at once, new file extensions and ransom notes, so a team that watches for them can act before the whole network is encrypted. This guide covers both, in the order a team needs them.
How do you detect ransomware?
MITRE ATT&CK describes the encryption stage (technique T1486, Data Encrypted for Impact) and lists what defenders can watch for. The signs are visible to a team that logs file activity, endpoint events and cloud storage changes.
- Many files rewritten in a short timeHigh-frequency file writes, often with an uncommon file extension.
- Ransom notes appearingNotes dropped in folders after files are changed.
- Virtual machine files encryptedDisk files in hypervisor datastores, such as .vmdk and .vmx files.
- Cloud storage objects replaced or encryptedUnexpected encryption or object replacement in cloud buckets.
- Protections switched offAttackers often disable security tools before they encrypt.
Encryption is usually the last step. CISA lists the common ways in as internet-facing vulnerabilities, compromised credentials, phishing, precursor malware, social engineering and third-party or managed service provider compromises. Watching for those earlier events, such as a strange remote login or a new tool on a server, gives more time than waiting for the ransom note. Exposed credentials and victim listings on criminal sites can also warn you first, which is what Ransomware Intelligence and our ransomware early warning use case cover.
What should you do first when ransomware is detected?
Isolate the affected systems at once. The CISA #StopRansomware Guide lists, under detection and analysis, isolating impacted systems, examining logs for precursor malware and hunting for persistence. Do not wipe systems yet: you need them to learn how the attacker got in.
- Disconnect affected devices from the network.
- Tell your incident response lead and, in the UK, report via the NCSC route at gov.uk/report-cyber. In the US, report to the FBI IC3 or Secret Service and contact CISA.
- Check which backups are intact before you tell anyone a restore date.
What does ransomware recovery involve?
You recover by finding and closing the way in, rebuilding systems from clean images, and restoring data from offline backups in order of business importance. The CISA guide describes containment and eradication as identifying the initial breach systems, disabling the malware and rebuilding from clean images, then restoring critical services first.
- ContainIsolate impacted systems and block the attacker’s access.
- Find the way inIdentify the first breached systems and any persistence.
- RebuildReinstall systems from clean images, reset credentials and secrets.
- RestoreBring back data from offline backups, most critical services first.
- ReviewRecord lessons learned and share indicators with CISA.
The UK NCSC adds that backups should be scanned for malware before a restore, and that you should keep multiple copies in different places. Its guidance says up-to-date backups are the most effective way of recovering from a ransomware attack.
How long does it take to recover from ransomware?
There is no standard time, and we do not know of an official figure. Recovery depends on how many systems were hit, whether backups survived, and whether data was also stolen. Real cases show the range: in the Colonial Pipeline attack the company restarted its whole system on 13 May 2021, six days after it shut down on 7 May. Attacks that destroy data, like NotPetya, can take far longer because the files cannot be recovered at all.
Can you recover files without paying the ransom?
Often yes, through backups. The NCSC and law enforcement do not encourage payment, because there is no guarantee you get access to your data and your systems stay infected. The No More Ransom project, run by Europol and the Dutch police, offers free decryption tools for some ransomware families. It says decryption is possible when the criminals made implementation errors, released keys, or when police seized key servers.
Stolen data is a different problem. Under double extortion, backups restore your files but do not stop a threat to publish what was copied. If your name appears on a ransomware leak site, treat it as a data breach and follow the steps on that page.
How do you build resilience before an attack?
Preparation decides how fast recovery goes. These measures come from the CISA guide and NCSC guidance, and our ransomware examples show what happens when they are missing.
- Backups: offline, encrypted, separate from the network and tested by real restores.
- Access: phishing-resistant multi-factor authentication, especially on remote access, and least privilege for accounts.
- Patching: fix internet-facing systems quickly and limit exposed remote desktop services.
- Segmentation: split the network so one infection cannot reach everything.
- People and plan: train staff to spot phishing, and exercise an incident response plan with named roles before you need it.
The ransomware trends reports track how attacker behavior changes, and the glossary entry on ransomware explains the basics.
Sources
The CISA #StopRansomware Guide provides the response checklist and entry points. The NCSC ransomware page and its guidance on mitigating malware and ransomware attacks cover payment, reporting and backups. MITRE ATT&CK T1486 lists the detection sources. Decryption tools: No More Ransom. The Colonial Pipeline dates are from our incident page, which cites the US Department of Energy.
Last checked against sources: 10 October 2026.