Ransomware Recovery Exercises: Rehearse the Restore

Ransomware Recovery Exercises

Ransomware attacks rarely stop at encrypting files. Attackers typically spend days or weeks inside the network beforehand: stealing credentials, gaining domain administrator rights, finding and deleting or encrypting backups, and exfiltrating data for extortion. By the time the ransom note appears, the organization faces simultaneous problems — systems down, identity infrastructure untrustworthy, backups possibly compromised, staff unable to work, and pressure from customers, regulators, and leadership.

Organizations that recover well have rehearsed. They know who decides what, how to isolate systems without destroying evidence, which credentials to reset and in what order, which backups are immutable and clean, how long a restore of Active Directory and critical applications really takes, and how the business operates while systems are down. Ransomware recovery exercises turn those assumptions into measured, practiced capabilities.

TL;DR

Run a progression of exercises: tabletops, component restore drills, and periodic end-to-end technical recoveries in isolated environments.
Practice containment decisions: network isolation, account disabling, and when to shut systems down.
Plan credential resets: privileged accounts, service accounts, cloud keys, and Active Directory's krbtgt account (reset twice).
Prove backups are immutable or offline, clean (predating the intrusion), and restorable within objectives.
Restore in dependency order: identity and core infrastructure first, then critical business services; decide rebuild versus restore.
Exercise communications, decision rights, and business continuity, and measure times against recovery objectives.

Quick Example

An exercise plan with injects and measured objectives:

Checking that the backup bucket enforces immutability (AWS S3 Object Lock):

Core Concepts

Exercise Types

Use realistic injects: missing backups, compromised administrator accounts, press inquiries, vendor involvement, and payroll deadlines. See Failure Injection and Recovery Exercises for running technical exercises safely.

Containment Decisions

Responders must decide quickly whether to isolate network segments, disconnect sites, disable accounts, shut down hypervisors, or cut internet access — balancing spread against business impact and evidence. Decide in advance who has authority to make these calls at 2 a.m., and practice them. Preserve evidence (memory, disk images, logs) where possible; investigators and insurers may need it.

Credential Resets

Assume all credentials that touched compromised systems are exposed:

Tier-0 accounts (domain admins, enterprise admins, identity provider global admins) and their passwords and MFA.
Service accounts and their dependent applications — inventory them beforehand.
Active Directory krbtgt: reset twice, allowing replication between resets, to invalidate forged Kerberos tickets.
Cloud and SaaS credentials, API keys, and backup system credentials.
Local administrator passwords (managed with LAPS or equivalents).

See Active Directory and Group Policy and Credential Compromise Containment and Recovery.

Backups That Survive Ransomware

See Database Backups and Database Restore Drills and Recovery Targets.

Recovery Order

Restore in dependency order: network and security controls, identity (directory services, identity provider), core infrastructure (DNS, DHCP, PKI, virtualization, backup systems), then critical business services ranked by impact, then everything else. For each system decide restore (from clean backup) or rebuild (from known-good images and configuration as code) — rebuilding is often safer for compromised servers. Recover into an isolated recovery environment before reconnecting to production. See Disaster Recovery Planning.

Business Continuity and Communications

Exercises should include manual workarounds (paper processes, offline payroll), internal and external communication templates, notification to regulators and insurers within required timelines, law enforcement contact, and how ransom decisions are made and by whom — a decision for leadership and legal, informed by sanctions rules, not for responders in the moment.

Measuring and Improving

Track time to detect, time to isolate, time to restore identity, time to first critical business service, and data loss compared with recovery time and point objectives. Record decisions and bottlenecks, assign actions, and repeat the exercise to confirm improvements. Typical findings: undocumented dependencies, backup credentials in the domain, missing service account inventories, and restore times far longer than assumed.

Best Practices

Rehearse Identity Recovery

Practice restoring directory services and resetting tier-0 credentials, since everything else depends on them.

Prove Immutability and Restore Times

Test that backups cannot be deleted with stolen admin credentials, and time real restores.

Decide Authority in Advance

Document who can isolate networks, shut down systems, notify regulators, and engage outside responders.

Include the Business

Bring finance, legal, communications, and operations into exercises; recovery is not only an IT problem.

Common Mistakes

Backups Reachable With Domain Admin

Restoring the Attacker

Untimed Recovery Plans

FAQ

What is a ransomware tabletop exercise?

A discussion-based exercise in which responders and business leaders walk through a realistic ransomware scenario, making decisions on containment, recovery, communications, and legal obligations to find gaps in plans and roles.

Why reset the krbtgt password twice?

Kerberos keeps the current and previous krbtgt keys, so resetting twice — with replication between resets — ensures tickets forged with the old key are no longer accepted.

What makes a backup ransomware-resistant?

Immutability or offline storage, separate credentials and management, retention long enough to reach a point before the intrusion, and regular tested restores.

In what order should systems be recovered after ransomware?

Network and security controls, identity infrastructure, core services such as DNS and PKI, backup and virtualization platforms, then business-critical applications by priority.

How often should ransomware recovery be exercised?

Tabletops several times a year, component restore drills monthly or quarterly, and end-to-end technical recoveries of critical systems at least annually.