Targeted ransomware attacks generally take place over a longer period of time, with sophisticated hackers taking their time to ensure their efforts are as lucrative as possible. With hackers focused on learning the ins and outs of their victim’s environments, ransomware attacks are rarely one and done.
Conducting a thorough forensics investigation post breach is critical to identifying the root cause and preventing future breaches. As we’ve seen, ransomware operators are known to execute repeat-ransomware attacks, where they target the same victim twice using the knowledge they gained or the tools they left behind from the initial intrusion.
This playbook offers guidance on investigating ransomware post breach.
