The advice I’ve always heard is disconnect network but leave powered for forensics/recovery. Some ransomware store the decryption key soley in memory, so it is lost upon power loss
That actually makes sense. We had a ransomware attack once. We also disconnected the device but I cant remember if we powered it off. At the time it stopped encrypting due to that since our network drives were not reachable anymore.
Is there actually a way to spread the encryption process to a server?
Best I understand the encryption key is needed to encrypt and decrypt, so if the malware isn’t written well enough it may well continue to store the encryption key in memory.
There’s some old malware on archive.org that just pulls the FAT off the filesystem into memory and offers a dice roll to restore it
I vaguely remember the advice actually being to leave it running but disconnect it from the internet. Although maybe hard disconnect the backups if you can.
Uh no
Go to the main breaker that feed the servers whatever. And pull the 600v switch off
The smartest layout for that situation is having the main breaker box close to the hooman IT operator room
No choice if it is very serious breach
The advice I’ve always heard is disconnect network but leave powered for forensics/recovery. Some ransomware store the decryption key soley in memory, so it is lost upon power loss
That actually makes sense. We had a ransomware attack once. We also disconnected the device but I cant remember if we powered it off. At the time it stopped encrypting due to that since our network drives were not reachable anymore.
Is there actually a way to spread the encryption process to a server?
Im not a it expert at alll. But reallly ?
Best I understand the encryption key is needed to encrypt and decrypt, so if the malware isn’t written well enough it may well continue to store the encryption key in memory.
There’s some old malware on archive.org that just pulls the FAT off the filesystem into memory and offers a dice roll to restore it
Depending on where the breaker is relative to the UPS, of course.
I vaguely remember the advice actually being to leave it running but disconnect it from the internet. Although maybe hard disconnect the backups if you can.
And probably the intranet, too, just to be safe.
Should be a trunk line disconnect switch that kills both power and data. And if your manager is cool, then it’s a guillotine switch.
No, have a Safety Control Rod Axe Man. The dropping rod hits the breakers and smashes it, cutting power!