Skip to content

Ransomware Attack

Your files have been encrypted and attackers are demanding payment (usually in cryptocurrency) to restore access. This is one of the most damaging types of cyber attacks for organizations.

Immediate Actions (First Hour)

  1. Do NOT pay the ransom immediately - Payment doesn't guarantee file recovery and funds criminal operations
  2. Isolate affected systems - Disconnect from network (unplug ethernet, disable WiFi) to prevent spread
  3. Do NOT turn off computers - Evidence in memory may be lost; isolate instead
  4. Document everything - Screenshot ransom notes, record affected systems
  5. Check backup status - Are your backups intact and unaffected?

Before Paying: Check for Free Decryption

Many ransomware variants have been cracked. Check these resources first:

No More Ransom Project

The #1 resource for free ransomware decryption tools.

ID Ransomware

Identify the ransomware strain affecting you:

Emsisoft Decryption Tools

Kaspersky No Ransom

Swedish Resources

CERT-SE

  • Report the incident: cert.se
  • 24/7 hotline: +46 10 240 40 40
  • Coordination with other affected organizations
  • Threat intelligence sharing

Police Report

  • File a report: polisen.se/anmal
  • Required for insurance claims
  • IT crime unit may investigate (large cases)

International Resources

CISA Ransomware Guide (US)

NCSC Ransomware Guidance (UK)

ENISA Ransomware Threat Landscape

Evidence to Preserve

Before attempting recovery, preserve:

  • [ ] Screenshots of ransom notes (all screens)
  • [ ] Ransom note files (.txt, .html files left by attackers)
  • [ ] Sample encrypted files (for identification)
  • [ ] System logs (Windows Event Logs, syslog)
  • [ ] Network logs (firewall, proxy)
  • [ ] Memory dumps (if possible, before shutdown)
  • [ ] List of affected systems and file shares

Recovery Options

Option 1: Restore from Backups

Best case scenario if backups are intact: - Verify backups are clean (not encrypted) - Wipe and rebuild affected systems - Restore data from backups - Change all credentials before reconnecting

Option 2: Free Decryption

If a decryptor exists: - Identify ransomware variant (No More Ransom, ID Ransomware) - Download appropriate decryptor - Test on a few files first - Document the process

Option 3: Pay Ransom (Last Resort)

We do not recommend paying, but if you must: - Paying does not guarantee recovery - You may be targeted again - Funds criminal operations - If you pay, report to nomoreransom.org so they can track the group

Guides & Documentation

NIST Ransomware Guide

SANS Ransomware Resources

Need Help?

If you're a Swedish organization that can't afford commercial incident response:

Apply to HackAid - Our BTH-trained volunteers provide free digital forensics assistance.

Last updated: 2026-01