What happens when you call

You will be asked what you are seeing, what still runs, and who has already been told. Nothing needs to be prepared and nothing needs to be established before you ring. If you do not yet know what happened, that is the ordinary case and it is the first thing worked on.

Containment comes first and rebuilding comes last, and the order matters more than the speed. A machine that is reimaged before it is imaged takes the answer with it: how they got in, what they reached, and whether they are still inside.

For ransomware, the family decides almost everything that follows: whether a free decryptor exists and really reaches your files, whether the group steals data before encrypting, and whether any sanctions listing touches it.

The inputs get assembled and set out plainly: the state of your backups, what a decryptor would and would not return, what was taken, and who has to be told. The decision to pay or to refuse stays with you. It is your decision, and it is not one anybody should take at 02:00 on a summary.

Where you decide to open one, it is run for you. That means opening and holding the channel with the group, and handling settlement through to acquiring the currency, transferring it and verifying that what comes back actually decrypts. Before any payment is discussed, the group, its known aliases and any wallet are screened against the OFAC SDN, UN and EU listings, and that check is recorded. The screening is not a step that can be skipped to save time, and it happens whether or not a payment is ever made.

Restoration runs against a known-good point, with the route in closed first. Coming back onto the same hole is how an organisation is encrypted twice in a month by the same group.

Indian reporting obligations run on their own timetable and they do not wait for the incident to be understood. CERT-In’s Directions require notification within six hours of noticing a covered incident, and that filing is handled in parallel by somebody who is not doing the technical work.