Ransomware encrypts or steals company data and demands payment for its return or for not publishing it. This guide explains how an attack typically unfolds: initial access through phishing, remote access without MFA or unpatched systems; reconnaissance and privilege escalation; lateral movement towards servers and backups; data exfiltration; deletion of backups; and finally encryption, often launched outside office hours. Encryption is the last step, so early detection can stop an incident before it becomes a crisis.
We set out a preparation checklist: the 3-2-1 backup rule with at least one offline or immutable copy, defined RPO and RTO and regular restore tests; strong MFA and closed public remote desktop; patching and EDR monitored around the clock; network segmentation; and a written, printed response plan. We then describe the first hours of an incident, from isolating devices and protecting backups to involving incident responders and seeking legal advice where personal data under KVKK is affected, followed by recovery and lessons learned. Racurity, the cyber security brand of Pedante Bilişim, builds and monitors these layers through expert solution partners.
Talk to Racoun: we are based in Istanbul and work with brands across Türkiye. Message us on WhatsApp or email ekip@racoun.com.
