recovering-from-ransomware-attack

从勒索软件攻击中恢复

何时使用

• 在勒索软件已加密生产系统，且已决定从备份恢复之后
• 在实际事件发生前构建或验证勒索软件恢复运行手册时
• 在收到解密密钥（支付赎金或执法部门提供）并需要安全解密时
• 在需要部分恢复以及对剩余系统进行解密时
• 执行恢复演练以验证 RTO 承诺时

请勿在完成遏制和取证范围界定之前使用。在不了解攻击者访问和持久化机制的情况下过早恢复，可能会导致再次感染。

前提条件

• 已宣布事件并完成遏制阶段（所有攻击者访问均已被切断）
• 取证证据已保留（磁盘镜像、内存转储、网络捕获）
• 备份完整性已验证（不可变/气隙副本已确认干净）
• 可用的干净构建介质（操作系统安装介质、黄金镜像）
• 恢复环境已准备就绪（与受感染基础设施隔离的干净网段）
• 恢复优先级列表已记录（按依赖顺序排列的 Tier 1/2/3 系统）

工作流

步骤 1：建立干净的恢复环境

构建与受感染网络隔离的恢复基础设施：

# Create isolated recovery VLAN
# No connectivity to compromised network segments
# Dedicated internet access for patch downloads only (via proxy)

# Recovery network architecture:
# VLAN 999 (Recovery) - 10.99.0.0/24
#   - Recovery workstations (10.99.0.10-20)
#   - Recovered DCs (10.99.0.50-55)
#   - Recovered servers (10.99.0.100+)
#   - Proxy for internet (10.99.0.1) - patches and updates only

# Firewall rules: DENY all from recovery VLAN to production VLANs
# Allow: Recovery VLAN -> Internet (HTTPS only, via proxy)
# Allow: Recovery VLAN -> Backup infrastructure (restore traffic only)

步骤 2：首先恢复身份基础设施

必须在任何加入域的系统之前恢复 Active Directory：

# AD Recovery Procedure
# Step 2a: Restore AD from known-good backup
# Use DSRM (Directory Services Restore Mode) boot

# 1. Build clean Windows Server from ISO
# 2. Promote as DC using AD restore
# 3. Restore System State from immutable backup

# Verify AD backup is pre-compromise
# Check backup timestamp against earliest known compromise date
wbadmin get versions -backuptarget:E: -machine:DC01

# Restore system state in DSRM
wbadmin start systemstaterecovery -version:02/15/2026-04:00 -backuptarget:E: -machine:DC01 -quiet

# After restore, reset critical accounts
# Reset krbtgt password TWICE (invalidates all Kerberos tickets)
# This prevents Golden Ticket persistence
Import-Module ActiveDirectory
Set-ADAccountPassword -Identity krbtgt -Reset -NewPassword (ConvertTo-SecureString "NewKrbtgt2026!Complex#1" -AsPlainText -Force)
# Wait for replication (minimum 12 hours), then reset again
Set-ADAccountPassword -Identity krbtgt -Reset -NewPassword (ConvertTo-SecureString "NewKrbtgt2026!Complex#2" -AsPlainText -Force)

# Reset all privileged account passwords
$privilegedGroups = @("Domain Admins", "Enterprise Admins", "Schema Admins", "Administrators")
foreach ($group in $privilegedGroups) {
    Get-ADGroupMember -Identity $group -Recursive | ForEach-Object {
        Set-ADAccountPassword -Identity $_.SamAccountName -Reset `
            -NewPassword (ConvertTo-SecureString (New-Guid).Guid -AsPlainText -Force)
        Set-ADUser -Identity $_.SamAccountName -ChangePasswordAtLogon $true
    }
}

# Validate AD health
dcdiag /v /c /d /e /s:DC01
repadmin /showrepl

步骤 3：在恢复之前验证备份完整性

# Scan backup files for ransomware artifacts before restoring
# Use offline antivirus scanning on backup mount

# Mount backup as read-only
mount -o ro,noexec /dev/backup_lv /mnt/backup_verify

# Scan with ClamAV
clamscan -r --infected --log=/var/log/backup_scan.log /mnt/backup_verify

# Check for known ransomware indicators
find /mnt/backup_verify -name "*.encrypted" -o -name "*.locked" \
    -o -name "*.lockbit" -o -name "DECRYPT_*" -o -name "readme.txt" \
    -o -name "RECOVER-*" -o -name "HOW_TO_*" | tee /var/log/ransomware_check.log

# Verify database consistency (SQL Server example)
# Restore database to temporary instance for validation
RESTORE VERIFYONLY FROM DISK = '/mnt/backup_verify/databases/erp_db.bak'
    WITH CHECKSUM

步骤 4：按优先级顺序恢复系统

遵循基于依赖关系的恢复顺序：

Recovery Order:
Phase 1 (Hours 0-4): Identity & Infrastructure
  1. Domain Controllers (AD, DNS, DHCP)
  2. Certificate Authority (if applicable)
  3. Core network services (DHCP, NTP)

Phase 2 (Hours 4-12): Critical Business Systems
  4. Database servers (SQL, Oracle, PostgreSQL)
  5. Core business applications (ERP, CRM)
  6. Email (Exchange, M365 hybrid)

Phase 3 (Hours 12-24): Important Systems
  7. File servers
  8. Web applications
  9. Monitoring and security tools (SIEM, EDR)

Phase 4 (Hours 24-48): Remaining Systems
  10. Development environments
  11. Archive systems
  12. Non-critical applications

# Veeam Instant Recovery - fastest restore for VMware/Hyper-V
# Boots VM directly from backup file, then migrates to production storage

# Instant recovery for Tier 1 system
Start-VBRInstantRecovery -RestorePoint (Get-VBRRestorePoint -Name "DC01" |
    Sort-Object CreationTime -Descending | Select-Object -First 1) `
    -VMName "DC01-Recovered" `
    -Server (Get-VBRServer -Name "esxi01.recovery.local") `
    -Datastore "recovery-datastore"

# After validation, migrate to production storage
Start-VBRQuickMigration -VM "DC01-Recovered" `
    -Server (Get-VBRServer -Name "esxi01.prod.local") `
    -Datastore "production-datastore"

步骤 5：验证已恢复系统并加固

在将已恢复系统连接到生产环境之前：

# Check for persistence mechanisms
# Scheduled Tasks
Get-ScheduledTask | Where-Object {$_.State -ne "Disabled"} |
    Select-Object TaskName, TaskPath, State, Author |
    Export-Csv C:\recovery\scheduled_tasks.csv

# Services
Get-Service | Where-Object {$_.StartType -eq "Automatic"} |
    Select-Object Name, DisplayName, StartType, Status |
    Export-Csv C:\recovery\auto_services.csv

# Startup items
Get-CimInstance Win32_StartupCommand |
    Select-Object Name, Command, Location, User |
    Export-Csv C:\recovery\startup_items.csv

# WMI event subscriptions (common persistence)
Get-WmiObject -Namespace root\subscription -Class __EventFilter
Get-WmiObject -Namespace root\subscription -Class __EventConsumer

# Registry run keys
Get-ItemProperty "HKLM:\Software\Microsoft\Windows\CurrentVersion\Run"
Get-ItemProperty "HKLM:\Software\Microsoft\Windows\CurrentVersion\RunOnce"
Get-ItemProperty "HKCU:\Software\Microsoft\Windows\CurrentVersion\Run"

# Verify no unauthorized admin accounts
Get-LocalGroupMember -Group "Administrators"
Get-ADGroupMember -Identity "Domain Admins"

# Apply latest patches before connecting to production
Install-WindowsUpdate -AcceptAll -AutoReboot

步骤 6：分阶段重新连接网络

Phase 1: Reconnect identity infrastructure
  - DCs online in production VLAN
  - Validate replication and authentication
  - Monitor for suspicious authentication patterns

Phase 2: Reconnect Tier 1 systems
  - One system at a time
  - Monitor EDR for 1 hour before proceeding to next
  - Validate application functionality

Phase 3: Reconnect remaining systems
  - Groups of 5-10 systems
  - Continue monitoring for re-infection indicators

Throughout: SOC monitoring on high alert
  - EDR in aggressive blocking mode
  - All previous IOCs loaded in detection rules
  - Canary files deployed on recovered systems

关键概念

术语	定义
DSRM	目录服务还原模式：域控制器的一种特殊启动模式，允许还原 AD 数据库
krbtgt 重置	两次重置 krbtgt 账户密码会使所有 Kerberos 票据失效，从而挫败黄金票据持久化
即时恢复	一种备份技术，直接从备份存储启动虚拟机以立即可用，同时在后台迁移数据
证据保留	在恢复开始之前保留取证镜像和日志，这是执法部门和保险索赔所要求的
干净构建	从可信安装介质重建系统，而不是尝试清理受感染系统
依赖链	基于服务依赖关系确定系统必须恢复的顺序（例如，AD 先于域成员）

工具与系统

• Veeam Instant Recovery：直接从备份启动虚拟机，RTO 接近零，然后实时迁移到生产环境
• Microsoft DSRM：AD 专用恢复模式，用于从备份还原域控制器
• DSInternals PowerShell Module：验证 AD 数据库完整性并识别恢复后受损的凭据
• Rubrik Instant Recovery：在几秒内将备份挂载为实时虚拟机，以快速验证恢复
• ClamAV：开源防病毒软件，用于在还原之前扫描备份文件

常见场景

场景：制造企业在 LockBit 攻击后实现全面恢复

背景：一家拥有 300 台服务器的制造商，其 80% 的基础设施被 LockBit 加密。48 小时前的不可变备份经验证干净可用。生产线已停工，每天损失 50 万美元。

方案：

1. 建立与受感染网络隔离的恢复 VLAN（10.99.0.0/24）
2. 使用 Veeam Instant Recovery 从不可变备份恢复 2 台域控制器（2 小时）
3. 间隔 12 小时两次重置 krbtgt 密码，重置所有管理员密码
4. 使用 dcdiag 验证 AD，使用 DSInternals 扫描 Golden Ticket 迹象
5. 恢复 ERP 数据库（SAP）并验证数据一致性（4 小时）
6. 恢复 MES（制造执行系统）和 SCADA 历史数据库（3 小时）
7. 先在隔离的 OT 网络中让生产线控制器上线
8. 在 48 小时内分阶段重新连接，并持续进行 EDR 监控
9. 总恢复时间：72 小时（在 96 小时 RTO 承诺范围内）

陷阱：

• 急于重新连接系统而未验证是否存在持久化机制，导致再次感染
• 从未经验证早于入侵时间的最新备份进行恢复（攻击者可能已污染近期备份）
• 未两次重置 krbtgt 密码，使攻击者得以维持 Golden Ticket 访问权限
• 恢复顺序错误（在数据库依赖项之前先恢复应用服务器）

输出格式

## Ransomware Recovery Status Report

**Incident ID**: [ID]
**Recovery Start**: [Timestamp]
**Current Phase**: [1-4]
**Estimated Completion**: [Timestamp]

### Recovery Progress
| Phase | Systems | Status | Started | Completed | RTO Target |
|-------|---------|--------|---------|-----------|------------|
| 1 - Identity | DC01, DC02, DNS | Complete | HH:MM | HH:MM | 4 hours |
| 2 - Critical | ERP, DB01, DB02 | In Progress | HH:MM | -- | 12 hours |
| 3 - Important | FS01, Email, Web | Pending | -- | -- | 24 hours |
| 4 - Remaining | Dev, Archive | Pending | -- | -- | 48 hours |

### Validation Checklist
- [ ] AD integrity verified (dcdiag, repadmin)
- [ ] krbtgt password reset (2x with interval)
- [ ] All admin passwords reset
- [ ] Persistence mechanisms scanned
- [ ] EDR deployed and active on recovered systems
- [ ] IOCs loaded in detection rules
- [ ] Canary files deployed