Dealing with a malware attack can be a stressful and confusing experience. Once you’ve identified and contained the attack, it’s important to take the right next steps to limit the damage and prevent future attacks. Here are some key questions and answers on what to do after a malware attack:
How do I recover from the attack?
First, identify what systems were impacted. Check all computers, networks, servers, websites, etc. that the malware may have touched. Then work to fully remove the malware from all infected systems. This can require completely wiping and reinstalling the OS on some machines. Be sure to change all passwords after removing the malware.
If you use backups or system images, you may be able to restore compromised systems to a pre-infection state relatively quickly. Be absolutely certain the backups/images themselves are not infected before relying on them for recovery.
With critical systems like public-facing web servers, focus on getting those back online and secured as fast as possible. Take other systems offline until they can be cleaned to avoid reinfection.
Should I pay the ransom?
If the attack included ransomware that encrypted your files, the attackers may want you to pay a ransom to get the decryption key. There are risks in paying, and no guarantee you’ll get working keys. Many experts recommend against paying ransoms.
First, check if you have unencrypted backups or copies of the files that you can restore from. Paying the ransom should be an absolute last resort. If you do decide to pay, treat the payment process like dealing with criminals (which they are).
How can I prevent this from happening again?
Truly protecting against future malware means taking a multilayered approach to security:
- Install and properly configure endpoint detection and response (EDR) tools to watch for malicious activity.
- Keep all software, including OSs, fully patched and updated.
- Use strong spam filters to block malicious emails.
- Train staff to recognize social engineering attacks and unsafe links/attachments.
- Segment networks and implement firewalls to limit lateral movement.
- Require strong passwords and enable multi-factor authentication wherever possible.
- Frequently backup critical data off-site or to isolated media.
- Monitor logs from firewalls, web filters, AV tools, etc. for signs of issues.
No single solution will provide full protection. Taking a layered, defense-in-depth approach to security makes you far more resilient to future malware incidents.
Should I contact law enforcement?
In many cases, it’s wise to contact law enforcement and report the attack. This opens an investigation that may be able to trace the attack back to the perpetrators. That said, manage expectations about what law enforcement can do. They will not be able to magically reverse the damage from the attack.
Have details ready about exactly what happened, what systems were impacted, what data was compromised, timestamps of the incident, IP addresses involved, and any other relevant details.
If you do make an insurance claim related to the attack, the insurance company will also want copies of any police reports.
How can I contain the damage?
An important part of responding to the attack is limiting the damage and prevent further compromise. Depending on what systems/networks were hit, this could involve:
- Isolating and shutting down compromised computers.
- Blocking suspicious IP addresses at firewalls.
- Rolling passwords and access controls on systems that may have been impacted.
- Taking public-facing web applications and servers offline until they can be inspected and secured.
- Notifying customers/users of potential exposure of their data.
Communicate with staff and relevant third parties quickly to keep people informed about impacted systems and damage control efforts. The faster you can respond, the better.
Should I hire outside help to investigate and remediate?
Unless your organization has skilled security professionals on staff, it’s usually wise to hire outside experts to assist with malware response. Companies like forensic investigation firms can help determine the root cause, measure the extent of compromise, thoroughly clean systems, and advise on strengthening defenses against future attacks.
The downside is outside help adds costs. Weigh the tradeoffs based on the severity, complexity, and business impacts of the attack. For many small businesses, the cost is justified by quickly getting expert help.
What other steps should I take during response?
Some other important response steps include:
- Document everything – all evidence, alerts, affected systems, actions taken, etc. Thorough documentation will help any investigation or insurance claims.
- Don’t destroy evidence – Keep impacted hard drives, log files, network traffic captures, etc. in case they are needed later.
- Assess legal obligations – You may have regulatory and legal duties around breach notification and cybersecurity controls.
- Evaluate business continuity – Can business operations continue if certain systems are offline? Are workarounds needed?
- Keep response discreet – Announcing a breach publicly too soon can have PR consequences.
Tread carefully and thoughtfully as you coordinate response and remediation efforts.
How can I prevent malware getting in?
Ultimately, the best protection is stopping malware before it can compromise your environment. Key prevention measures include:
- Training staff to avoid unsafe links/attachments, questionable websites, and social engineering.
- Using strong spam filtering to block malicious emails.
- Keeping software patched and updated promptly.
- Running antivirus software and monitoring for malware signatures.
- Scanning inbound and outbound traffic at firewalls for known threats.
- Monitoring network traffic and endpoint behavior for anomalies.
- Securing public-facing applications and remote access methods.
There is no single magic bullet. Effective prevention involves using multiple tools and techniques to safeguard systems and watch for suspicious activity.
Should I worry about future attacks?
Being the victim of a targeted attack often means the attackers will try again. After recovering from the initial incident, continue monitoring systems closely for suspicious activity and unauthorized access attempts. Attackers frequently use the same entry points and tools repeatedly once they find a weakness in a target’s defenses.
Implement additional logging and alerts on critical assets to watch for follow-up attacks. Assume the attackers still have footholds or backdoors into your environment. Use this incident as justification for strengthening cyber defenses across the board.
How much downtime and lost business should I expect?
The amount of downtime and business disruption caused by a malware attack widely varies:
| Attack Severity | Potential Downtime |
|---|---|
| Minor infection on a few systems | Minimal – hours up to a couple days |
| Moderate infection across network | Significant – several days up to 1-2 weeks |
| Major attack that cripples IT systems | Severe – several weeks up to months |
Lost revenue and costs driven by business disruption can exceed the direct recovery costs from the attack. Have plans in place to continue critical operations even with IT systems offline. Also consider cyber insurance to help offset lost revenue costs.
What mistakes should be avoided?
Some common mistakes to avoid after a malware attack include:
- Underestimating the extent of the compromise
- Failing to thoroughly wipe and rebuild compromised systems
- Keeping the breach quiet without notifying customers/partners
- Not bringing in outside expert help when needed
- Trying to deal with everything internally without reporting to law enforcement
- Not evaluating and improving security defenses for the future
Effective response requires understanding the full impact, completely removing malware remnants, communicating appropriately, and learning from the incident.
What are the risks of a poorly handled response?
Botching the response to a malware attack can multiply the harm done and leave the organization in an even worse situation. Potential consequences include:
- Failing to fully eliminate the malware allows continued access, stealing of data, and system damage.
- Not notifying affected customers destroys public trust if a breach becomes public later.
- Inability to restore business operations quickly leads to severe revenue and productivity losses.
- Lack of improvement to defenses leaves the organization open to repeat attacks.
- Loss of important evidence hurts legal and insurance actions later.
Mishandling the aftermath of an attack makes the recovery process far more difficult and painful over the long run.
Conclusion
Recovering from a malware attack requires methodically assessing the damage, remediating impacted systems, protecting data, notifying appropriate parties, minimizing business disruption, improving defenses, and documenting evidence. Moving too slowly or failing to take the right steps often compounds the harm from the incident and leaves the organization open to further cybercrime down the road.
By understanding the key questions that need to be answered and bringing in outside expertise when required, businesses and organizations can respond effectively to malware events. With proper planning and preparation, even severe incidents can be overcome and crucial operations restored in a reasonable timeframe.