Ransomware recovery: the steps to restart without getting reinfected

The short answer: after a ransomware attack, the worst decision is to restore everything as fast as possible onto the same machines. The attacker often got in days or weeks before encryption, created accounts, installed tools and located the backups: restoring without cleaning hands them the keys again. Recovery follows a precise order: understand how they got in and what they left behind, rebuild the directory and critical servers on clean foundations, restore data from a verified backup, change every secret, then restart in stages under monitoring.

This guide follows our article on the incident response plan and the first hour. At ALLSAFE SOLUTIONS, a managed IT provider in Casablanca, we support these recoveries as part of our backup and business continuity in Morocco offering. The steps described draw on CISA’s #StopRansomware guide, the Cybermalveillance.gouv.fr ransomware checklist and Microsoft’s Active Directory documentation.

Before rebuilding: understand what happened

The analysis phase feels like wasted time when the business is at a standstill. Yet it is what prevents the second attack. It answers three questions.

How did the attacker get in?

The most common entry points are well known: a malicious email opened on a workstation, exposed remote access (remote desktop, VPN without multi-factor authentication), an unpatched flaw on a firewall or exposed server, a stolen or reused password. Until the entry point is identified and closed, any rebuild remains fragile. CISA also recommends examining the email accounts and systems involved in the initial compromise.

What did they do in the network?

CISA’s guide lists the traces to look for:

• Active Directory accounts created or given elevated rights, unusual domain admin activity;
• misuse of built-in Windows tools to prevent recovery (deleting shadow copies, disabling recovery);
• unexpected remote management software, unusual PowerShell scripts, credential theft tools;
• new services and scheduled tasks;
• abnormal outbound data volumes, a sign of exfiltration before encryption.

That last point matters: many groups steal data before encrypting it, then threaten to publish it. Restoring does not solve that risk, which then becomes a legal and communication matter.

How far did it spread?

List what is affected and what is not, starting from the critical systems list in the recovery plan. Firewall, EDR and email logs help rebuild the timeline. Keep this material: it will be needed for the insurer and the police complaint.

Identify the ransomware family and look for a decryptor

The ransom note and the extension of encrypted files often identify the family. The No More Ransom project, launched by Europol, the Dutch police and security vendors, publishes free decryption tools for some families. It is always worth checking; but for recent families there is often no tool. Authorities advise against paying the ransom: there is no guarantee of recovering the data, and the attacker keeps a copy of what was stolen.

The rebuild order

You do not bring everything back at once. CISA recommends rebuilding by priority, from standard images, and connecting only clean systems in an isolated recovery network.

Order	What is rebuilt	Why
1	Firewall and remote access	Close the entry point, cut the attacker’s access
2	Backup infrastructure	Have a clean platform to restore from, isolated from the rest
3	Active Directory and admin accounts	Everything else depends on it; a compromised directory reopens everything
4	Critical systems from the recovery plan	Email, ERP, file server, telephony depending on the business
5	Workstations	Reinstalled or cleaned, checked one by one before reconnection

Firewall and remote access

Before reconnecting anything, check the firewall: up-to-date firmware, admin accounts reviewed, inbound access rules closed unless needed, VPN with multi-factor authentication. If the entry point was a flaw in the device, apply the patch before putting it back into service; our patch management guide details the method.

Active Directory

This is the most delicate part. If the attacker obtained domain admin rights, the whole directory must be considered compromised. There are two routes: restore a domain controller from a backup taken before the intrusion and then clean it, or rebuild. Either way, remove the accounts and delegations added by the attacker, review privileged groups and reset the krbtgt account password twice, as Microsoft recommends, leaving replication time and the maximum ticket lifetime between the two resets. We cover these settings in our Active Directory hardening guide.

Servers and data

Affected servers are reinstalled from clean installations, then data is restored from a backup taken before the attack, checked before use. Restoring yesterday’s full virtual machine is only acceptable if the analysis showed it was not compromised at that date.

Choosing a clean backup

Backup is what separates a recovery from a disaster. But it has to be usable:

• it must have survived: attackers target connected backups. Only an offline copy or an immutable copy, as described in our immutable 3-2-1 backup guide, offers reasonable assurance;
• it must predate the intrusion, not just the encryption: the timeline built during analysis gives the right date;
• it must be checked: antivirus scan of restored data, restore first into an isolated network;
• it must be restorable within an acceptable time: that is what regular restore tests measure, as described in our method to test a backup restore.

Veeam, for example, offers a secure restore that scans data with an antivirus before putting it back into production; it is a setting to plan before the incident.

Change every secret

Once the environment is rebuilt, CISA recommends resetting passwords for all affected systems. In practice:

• domain admin accounts and service accounts;
• local admin passwords on workstations and servers, ideally unique per machine with Windows LAPS;
• console accounts: firewall, hypervisors, backup, Microsoft 365, EDR;
• user accounts, enabling multi-factor authentication where it was missing;
• exposed keys and certificates, application access tokens.

Restart in stages

Services come back in steps, starting with the functions the business cannot do without. Each stage is closely watched: EDR active on every reconnected workstation, firewall alerts and directory logs followed continuously. Cybermalveillance.gouv.fr stresses this gradual, controlled restart, to detect a new attempt before it spreads.

Communicating during recovery

Recovery is not only technical. Staff need to know which tools they can use, which they must not switch on, and how to work in degraded mode: paper forms, mobile phones, a temporary mailbox if email is down. Clients and suppliers may have received malicious emails sent from your accounts, or may be affected if their data was stolen; they should hear about it from you, in clear and accurate terms, after review by legal counsel. Internally, a single spokesperson and a short status update at fixed times avoid rumours and contradictory instructions. Finally, keep a record of every decision and every action: the insurer, the police and the post-incident review will need it.

After recovery: don’t live through the same attack again

The lessons-learned review is the last step, and the one most often skipped. It answers three questions: how the attacker got in, why they were not detected earlier, and what slowed the recovery. The answers lead to a dated action plan: multi-factor authentication everywhere, patching, network segmentation, endpoint detection, immutable backup, and an updated disaster recovery plan. The basic prevention measures are summarised in our article on the 7 measures against ransomware.

Ransomware recovery checklist

• Entry point identified and closed.
• Attacker accounts, scheduled tasks and tools searched for and removed.
• Evidence kept: logs, machine images, ransom note.
• Decryptor checked on No More Ransom.
• Firewall, backup and Active Directory rebuilt first; krbtgt reset twice if the directory was compromised.
• Servers reinstalled, data restored from a verified backup taken before the intrusion.
• All passwords and secrets changed, multi-factor authentication enabled.
• Staged restart under heightened monitoring.
• Written lessons learned and a dated action plan.

How we do it

We start with a free initial audit of your recovery capability: offline or immutable backups, restore tests, Active Directory status, remote access and endpoint detection. We put in place backups that can withstand ransomware and a tested recovery plan. If an incident occurs, our 24/7 monitoring team handles a critical incident in under 15 minutes, remotely, with on-site intervention from Casablanca when needed, and leads the rebuild in the order described here, alongside our business cybersecurity in Morocco offering.

As a Veeam partner and Microsoft partner, we deploy backups and administer our clients’ directories every day. Request your free initial audit: we reply within 24 business hours.