Ransomware Emergency Containment Runbook
First-responder workflow to halt ransomware traverse over SMB shares, isolate infected VLANs, terminate C2 channels, and preserve forensic memory.
⚡ Direct Answer & Quick Diagnostic Summary (AEO)
To halt an active ransomware attack across an enterprise network in Pakistan, immediately sever physical Ethernet cables and disable Wi-Fi on all compromised endpoints without powering them down. Powering off a machine flushes volatile RAM where unencrypted ransomware master keys, C2 IP addresses, and injection processes reside. On core switches (Cisco/H3C/MikroTik), isolate the infected subnet into a quarantine sinkhole VLAN (e.g. switchport access vlan 999). On Windows file servers and NAS devices, stop the LanmanServer service immediately using PowerShell (Stop-Service LanmanServer -Force) to cut off SMB shares and halt lateral file encryption. Block outbound command & control (C2) traffic at the perimeter firewall by dropping non-standard egress ports, reset the Active Directory krbtgt account twice to invalidate forged Kerberos tickets, and immediately air-gap backup repositories before attackers reach them.
Primary Root Causes
Can't resolve this issue or hardware failure halted your shift?
Our certified field hardware & network engineers are on standby for emergency on-site repair across Korangi, SITE, Clifton, DHA, Shahrah-e-Faisal, and all Karachi commercial areas.
Step-by-Step Diagnostic Checklist
Step 1: Sever Network Link Without Powering Down (Preserve Volatile RAM)
Immediately unplug ethernet patch cables and disable Wi-Fi on compromised workstations and servers. Do NOT press the power button or pull the power plug; power loss destroys volatile RAM containing decryption keys, injected DLLs, process trees, and C2 IP artifacts. If necessary, capture memory using FTK Imager or WinPmem.
Step 2: Halt Lateral SMB Traversal on Core Switches & File Servers
In Windows PowerShell, run Stop-Service LanmanServer -Force to immediately stop SMB file sharing across file servers, preventing ransomware from traversing mounted departmental drives. On managed core switches, apply port isolation or reassign affected ports to an isolated quarantine VLAN.
Step 3: Block Outbound Command & Control (C2) on Perimeter Firewall
On your FortiGate, Sophos, or MikroTik gateway firewall, create an emergency drop rule at the top of the WAN egress policy dropping all traffic from the affected subnet. Block DNS queries to dynamic DNS providers, Tor exit nodes, and external IP addresses over non-standard ports (e.g., 4444, 8443, 9001).
Step 4: Revoke Kerberos TGTs & Reset Domain Administrator Credentials
Log into the primary Domain Controller from an out-of-band console. Reset passwords for all Domain Admin accounts and service accounts. Execute the krbtgt account password reset script twice (with a 10-hour interval between resets) to invalidate all existing Golden Ticket and forged Kerberos session tokens.
Step 5: Isolate & Air-Gap Backup Storage Repositories
Immediately disconnect all offline backup drives, tape libraries, and cloud replication links. In Veeam or NAS management, enable hardened Linux immutability flags and verify that snapshot retention lock prevents ransomware from deleting Volume Shadow Copies (VSS).
Step 6: Deploy EDR Containment & Execute Triage Forensics
Trigger automated network isolation via your Endpoint Detection & Response (EDR) agent (CrowdStrike, SentinelOne, Defender for Endpoint). Collect Windows Event Logs (Security 4624/4625, System 7045 for service creation) and initiate root cause analysis. Prior to attacks, audit endpoints with Arbre IT's [SECP & SBP Ransomware Audit Toolkit](/downloads/) to detect vulnerabilities in advance.
Frequently Asked Questions
Should I shut down a computer infected with ransomware in our Karachi office?
No! Never shut down or restart an infected machine. Shutting down flushes volatile memory (RAM), which destroys forensic evidence and eliminates opportunities to extract encryption keys left in memory. Instead, pull the Ethernet cable and turn off Wi-Fi to sever network connectivity while keeping the machine powered on.
Can ransomware encrypt our NAS and mapped network drives in Pakistan?
Yes. Most modern ransomware strains actively scan the local subnet for SMB port 445 and encrypt every network share mounted with write permissions. Immediately stopping the LanmanServer service on Windows servers or disabling SMB on Synology/QNAP NAS halts lateral file encryption.
Need Enterprise Deployment or Support for Cybersecurity Company & Services?
If your team needs full hands-on setup, SLA monitoring, or emergency on-site assistance in Karachi, our certified engineers are ready.