Technical analysis
Do not identify a ransomware family from a file extension alone
Extensions and ransom notes are leads. Attribution requires comparable samples, behavior and timelines, with an explained confidence level.
Tùng TEKVerifiedNo Ransomware • Knowledge for SMEs
Ransomware knowledge
Understand indicators, prepare copies and preserve data. Sourced guidance for operators, leadership and users.
From awareness to incident response
Start by distinguishing indicators from evidence. Check backups, administrator permissions and application recovery. During an incident, isolate connections and preserve originals before making changes to data.
RAID, snapshots, decryptors and RFC answer different questions. A term or sample percentage cannot replace checks on the actual system.
Prevention
Backup 3-2-1-1-0: backups must be paired with restore tests
Understand each part of 3-2-1-1-0 and test whether backups are usable when the primary system fails.
Tùng TEKVerified
Forensic
Forensic timelines: reconstruct incidents from verifiable timestamps
Combine logs, metadata and storage artifacts into a sourced timeline while retaining gaps and clock discrepancies.
Tùng TEKVerified
Ransomware knowledge
Understanding ransomware: from changed extensions to operational risk
No Ransomware knowledge for SMEs: encryption, data theft, decryptors, RAID and backups. Read indicators in context and avoid evidence-destroying reactions.
No.Ransomware.VNGuidance document
Prevention & response
Ransomware response: isolate, preserve and choose a recovery route
No Ransomware checklist: control connections, preserve evidence, assess backups and RFC for SQL, NAS, RAID, ESXi and Hyper-V before recovery.
No.Ransomware.VNGuidance document