Ransomware

Protected copy

1. Evidence. D205 is encrypted in the specified scenario. N205 demands payment; protected B205 remains readable. The controlled encryption event is known from the exercise setup. E205 preserves its selected event metadata and pre-event digest, not a usable recovery copy. N205 is an attacker demand, not proof of decryption ability or disclosure. B205’s state differs between isolated runs. The operator’s decryption key is not available to the recovery workflow. Identity and read grants are unchanged.
2. Read. A fresh authorized dispatch request returns 503 without records. Valid identity and permission do not make encrypted application data usable. Maya’s established identity has the ordinary dispatch-read grant. DispatchDesk tries to parse its selected active data and cannot serve the dispatch rows, returning 503 and no records. This observes the failed business task rather than inferring it solely from a note or changed file extension. Evidence E205 and demand N205 remain; other systems and possible disclosure are unassessed.
3. Restore. Nora submits the exact approved restoration to the isolated test service. B205’s rows are restored, but no fresh task result exists yet. The restore endpoint checks Nora’s trusted identity and exact B205/test-service scope. It independently parses the selected copy before replacing test data. Intact B205 passes and its bytes become the test service’s data. Successful restoration is an application change, not a working-task test or permission to reconnect production.
4. Retest. An independent authorized read of the test service returns the exact pre-event dispatch rows. Production return and investigation remain open. A new GET checks the resulting test-service state using Maya’s unchanged identity and read grant. It returns 200 with the exact B205 rows, including order D205, quantity 10 and dispatch bay A. Only this selected isolated task is demonstrated. E205, N205 and the selected backup are retained. Possible theft, continuing attacker access, other dependencies and production return require separate work.

Copy also encrypted

1. Evidence. D205 is encrypted in the specified scenario. N205 demands payment; reachable B205 was also encrypted. The controlled encryption event is known from the exercise setup. E205 preserves its selected event metadata and pre-event digest, not a usable recovery copy. N205 is an attacker demand, not proof of decryption ability or disclosure. B205’s state differs between isolated runs. The operator’s decryption key is not available to the recovery workflow. Identity and read grants are unchanged.
2. Read. A fresh authorized dispatch request returns 503 without records. Valid identity and permission do not make encrypted application data usable. Maya’s established identity has the ordinary dispatch-read grant. DispatchDesk tries to parse its selected active data and cannot serve the dispatch rows, returning 503 and no records. This observes the failed business task rather than inferring it solely from a note or changed file extension. Evidence E205 and demand N205 remain; other systems and possible disclosure are unassessed.
3. Restore. Nora submits the exact approved restoration to the isolated test service. The service rejects unreadable B205 and does not activate a replacement. The restore endpoint checks Nora’s trusted identity and exact B205/test-service scope. It independently parses the selected copy before replacing test data. Also-encrypted B205 fails that validation. The endpoint returns 422 with no replacement data applied. The attempted restore does not obtain the operator’s key or recover the rows.
4. Retest. An independent authorized read of the test service still returns 503 and no rows. Production return and investigation remain open. A new GET checks the resulting test-service state using Maya’s unchanged identity and read grant. It returns 503 without rows because no readable replacement was applied. A failed restore request cannot be promoted to verified recovery. E205, N205 and the selected backup are retained. Possible theft, continuing attacker access, other dependencies and production return require separate work.

This exercise starts after a specified encryption event; an error or ransom note alone would not prove its cause. Harmless local buffers model affected data and backup reachability, not malware, a real isolated network or real attacker access. Trusted recovery authority and suitable test configuration are assumed. A successful selected test does not establish a clean environment, complete recovery or absence of data theft. Payments, safety systems, other services and production return are outside the exercise.

Flow references: CISA: ransomware, backups and controlled recovery