Ransomware can spread rapidly across computers, servers, shared storage and connected networks. The actions taken immediately after detection can determine whether an incident remains contained or develops into a major organisational disruption.
This playbook provides the immediate actions an organisation should take to contain suspected ransomware and preserve evidence before contacting NC4 for coordinated incident response.
It is intended for government institutions, county governments, businesses, hospitals, universities, financial institutions, critical infrastructure operators and other organisations operating in Kenya.
1. IDENTIFY THE WARNING SIGNS
Treat the incident as suspected ransomware if you observe one or more of the following:
Files suddenly becoming inaccessible or encrypted;
File names or extensions changing unexpectedly;
A ransom message appearing on computers or servers;
Large numbers of files being modified or deleted;
Multiple computers becoming unavailable at the same time;
Security tools being unexpectedly disabled;
Users being locked out of systems;
Unusual administrator accounts or login activity;
Shared drives becoming inaccessible;
Backups being unexpectedly deleted or modified.
If ransomware is suspected, move immediately to containment.
2. ISOLATE THE AFFECTED DEVICE
DO NOT REBOOT THE DEVICE.
If the computer or server is still powered on, leave it powered on where possible.
Immediately disconnect it from the network.
For a workstation or laptop:
- Unplug the Ethernet/network cable.
- Disconnect Wi-Fi.
- Disconnect from VPN.
- Disconnect unnecessary external storage devices.
For a server:
Use your organisation's ICT or cybersecurity personnel to isolate the server from the network without unnecessarily powering it down.
If your organisation uses an Endpoint Detection and Response platform:
Use the platform's network isolation capability where available.
The objective is simple:
_Stop the affected device from communicating with other systems while preserving it for investigation._
3. IF MULTIPLE DEVICES ARE AFFECTED, CONTAIN THE NETWORK
If ransomware appears on more than one computer, assume that the attacker may already have access to other parts of the organisation.
Immediately:
Isolate affected network segments;
Restrict communication between user networks and server networks;
Block unnecessary remote-access connections;
Review and restrict VPN access;
Restrict unnecessary SMB/file-sharing traffic;
Isolate visibly affected servers and workstations;
Use firewall or network controls to prevent further movement where possible.
Do not wait for every device to display a ransom note before taking action.
A computer that has not yet been encrypted may still be compromised.
Critical Infrastructure
For hospitals, energy facilities, water systems, industrial environments and other safety-critical services, network isolation should be coordinated with responsible operational personnel to avoid creating an additional safety or service-continuity incident.
4. PROTECT YOUR BACKUPS
Ransomware operators frequently attempt to destroy backups before encrypting production systems.
Immediately determine whether backup infrastructure is still accessible from the affected network.
Where operationally appropriate:
Isolate backup infrastructure from compromised networks;
Protect offline and immutable backups;
Prevent affected systems from accessing backup repositories;
Secure backup administrator accounts;
Stop unnecessary connections between production and backup environments.
DO NOT:
- Connect offline backup drives to affected systems;
- Begin restoring backups;
- Delete existing backups;
- Assume that a backup is clean simply because it is available.
Do not begin restoration until the extent of the compromise has been established.
5. PROTECT USER AND ADMINISTRATOR ACCOUNTS
Ransomware attacks frequently involve compromised user, administrator, VPN or remote-access accounts.
Immediately identify and disable confirmed compromised accounts where this can be done safely.
Give particular attention to:
Domain administrator accounts;
System administrator accounts;
VPN accounts;
Remote-access accounts;
Backup administrator accounts;
Cloud administrator accounts;
Newly created privileged accounts.
Do not conduct uncontrolled organisation-wide password resets before understanding whether the identity environment itself has been compromised.
NC4 incident responders can assist in determining the appropriate credential-reset strategy.
6. PRESERVE THE EVIDENCE
Do not destroy information that may help determine how the attacker entered the organisation.
Preserve:
- The affected devices;
- Ransom notes;
- Screenshots or photographs of messages;
- Suspicious emails;
- Suspicious files;
- Firewall logs;
- VPN logs;
- Server logs;
- Active Directory and authentication logs;
- Endpoint-security alerts;
- Email-security logs;
- Cloud audit logs;
- Relevant CCTV or physical-access information where applicable.
Record:
When was the incident first noticed?
Who discovered it?
Which device was affected first?
What systems are currently affected?
What actions have already been taken?
Do not modify evidence unnecessarily.
7. DO NOT DO THESE THINGS
During the initial response:
DO NOT REBOOT affected computers or servers unless required for immediate safety or there is no other practical way to stop ongoing destructive activity.
DO NOT FORMAT affected devices.
DO NOT REINSTALL operating systems.
DO NOT DELETE malware or ransom notes.
DO NOT RUN random ransomware-removal or decryption tools downloaded from the internet.
DO NOT CONNECT BACKUPS to the compromised network.
DO NOT BEGIN RESTORING systems.
DO NOT COMMUNICATE WITH THE ATTACKER using personal accounts.
DO NOT PAY OR NEGOTIATE A RANSOM independently.
DO NOT PUBLICLY ATTRIBUTE the attack to a particular ransomware group without verification.
DO NOT ALLOW multiple technical teams to make uncoordinated changes to affected systems.
Once the immediate spread has been contained, preserve the environment and escalate the incident.
8. MAINTAIN ESSENTIAL SERVICES SAFELY
Containment should not create unnecessary secondary disruption.
If critical digital services have been affected, activate the organisation's approved business-continuity procedures.
Depending on the organisation, this may involve temporary manual procedures or alternative service-delivery arrangements.
Priority should be given to:
Life and safety;
Essential public services;
Critical infrastructure;
Essential financial operations;
Emergency communications;
Protection of sensitive information.
Do not reconnect compromised systems simply because an essential service is unavailable.
9. CONTACT NC4 IMMEDIATELY
Once immediate containment actions have begun, report the incident to the National Computer and Cybercrimes Coordination Committee (NC4) for coordinated incident-response support.
NC4 CYBERCRIME HOTLINE
+254 716 148 341
info@nc4.go.ke
ONLINE
Use the Report Cyber Incident service on the official NC4 website here.
When contacting NC4, provide as much of the following information as is safely available:
Organisation name
Name and contact of the incident focal person
Time the incident was discovered
Number and type of systems affected
Whether critical services have been disrupted
Photograph or screenshot of the ransom note
Any unusual file extension observed
Whether servers, endpoints or backups are affected
Any known suspicious IP addresses, domains or email addresses
Containment actions already taken
Do not delay reporting because every technical detail is not yet known.
NC4 can coordinate the next stage of incident response and determine the appropriate technical, forensic and investigative support.
10. STOP AT CONTAINMENT
Once the affected systems have been isolated, evidence preserved and NC4 contacted:
Do not wipe, rebuild, restore or reconnect affected systems until the incident-response team has assessed the environment.
Premature restoration can:
Destroy forensic evidence;
Reintroduce ransomware;
Leave attacker access intact;
Contaminate clean backups;
Make it difficult to determine whether information was stolen;
Allow the attacker to regain control of recovered systems.
The objective of the organisation's first response is therefore not to investigate or recover the entire environment.
The objective is to:
CONTAIN THE INCIDENT
PRESERVE THE EVIDENCE
PROTECT ESSENTIAL SERVICES
REPORT TO NC4
RANSOMWARE: THE FIRST 15 MINUTES
1. DETECT
Identify suspected ransomware activity.
2. DISCONNECT
Isolate affected computers and servers from the network.
3. CONTAIN
Restrict affected network segments and remote access.
4. PROTECT
Secure backups and privileged accounts.
5. PRESERVE
Do not reboot, wipe or delete evidence.
6. RECORD
Document what happened and what actions were taken.
7. REPORT
Contact NC4 for coordinated incident response.
REMEMBER
DO NOT PANIC.
DO NOT REBOOT.
DO NOT WIPE.
DO NOT RESTORE.
ISOLATE THE AFFECTED SYSTEMS.
PRESERVE THE EVIDENCE.
CONTACT NC4.
Early containment can prevent one compromised computer from becoming an organisation-wide ransomware incident.
Here to help
Something doesn’t look right?
Prepare an incident report with the details that matter.