If You've Been Hit by a Ransomware Attack
Cryptolocker and similar ransomware lock the files of corporate and individual users using strong encryption algorithms, blocking access and demanding a ransom in return. Paying the ransom is no guarantee that your files will be returned, and it financially supports the attackers. For this reason, the first step should always be to obtain a technical assessment before making any payment.
Scope of Service
- Identification of the ransomware family involved
- Reverse-engineering analysis of the encryption method
- File recovery attempts based on known vulnerabilities
- System cleanup and support to prevent reinfection
- Backup and post-incident security recommendations
Not every ransomware family uses the same encryption strength; some families have known vulnerabilities that allow file recovery. For this reason, reaching out immediately after an attack — without shutting down the system or deleting files — increases the likelihood of recovery.
What to Do During an Attack
Isolate the Network
Disconnect the affected device from the network to stop the virus from spreading.
Do Not Pay the Ransom
Payment does not guarantee your files will be returned and may reduce your chances for analysis.
Get in Touch
Share the situation along with samples of the encrypted files and the ransom note.
Analysis & Recovery
The virus family is identified and the appropriate recovery method is applied.
The preliminary analysis and demo recovery are always free. If, after the demo stage demonstrates that the content is recoverable, you choose not to proceed with the full recovery, a fee of 250 USD + VAT applies, covering the analysis and demo work already performed.
File content is not of interest; only the requested technical operation is carried out. The file may need to be opened to the extent required for recovery verification, but its content is never copied, shared with third parties, or retained on our systems after delivery. If requested, a written confidentiality commitment is also provided.
Frequently Asked Questions
Should the ransom be paid?
It is recommended to obtain a technical analysis first; payment does not guarantee your files will be returned and financially strengthens the attackers. The analysis provides a realistic and honest assessment.
Is it possible to recover files from every ransomware?
It depends on the virus family and the encryption algorithm used; in many cases, recovery has been successfully achieved. The preliminary analysis is always free and provides a realistic probability assessment.