Incident › Module 7 › Lesson 1
Ransomware Named
Ransomware literacy — impact categories, encryption scope, extortion vectors, defender response vocabulary — on YOUR `$IR_LAB` tabletop scenarios only.
Visual · t34_ransomware_named
Ransomware = named defender literacy. $IR_LAB tabletop. Original Cyberlium.
Opening
Ransomware incidents combine technical impact and business pressure — name defender vocabulary on YOUR lab tabletop, never payload creation or payment crime how-tos.
Ransomware literacy names: encryption impact category (files, shares, backups literacy stub), extortion vector category (note, leak threat literacy stub), initial access path category from tabletop stub, blast radius assessment category, and defender response phases (contain, eradicate, recover, notify literacy). Analyst documents ransomware scenario card on `$IR_LAB` instructor tabletop — fictional org, labeled assets, synthetic timeline — without building ransomware payloads, without testing encryptors on unauthorized systems, without criminal marketplace access. Cyberlium teaches defender decision literacy for tabletop exercises — YOUR notes under $HOME/cyberlium-lab/t34-ir/. Refused: payload creation, decryptor crime how-tos, payment negotiation scripts, prod impact without RoE. Lab row: ransomware scenario card (impact, vectors, scope, response phase stub).
1. Named ransomware impact rows
Encryption scope, extortion vector, initial access path, blast radius, response phases — five literacy anchors.
All assets fictional on `$IR_LAB` tabletop — not live victim org data.
Command guide
Try these commands — Named ransomware impact rows
═══ TOOLS & WEBSITES ═══ Browse / read these (authorized learning only — stay in YOUR lab / program scope)
CISA Stop Ransomware — https://www.cisa.gov/stopransomware CISA ransomware guide — https://www.cisa.gov/stopransomware/ransomware-guide NIST SP 800-61 — https://csrc.nist.gov/publications/detail/sp/800-61/rev-2/final
═══ INSTALL ═══
Linux (Debian/Ubuntu):
Command — copy this
sudo apt install curl
macOS: Built-in
Windows: Built-in (PowerShell: Invoke-WebRequest)
═══ LINUX / macOS ═══
Command — copy this
export IR_LAB=${IR_LAB:-$HOME/cyberlium-lab/t34-ir}
curl -sS https://www.cisa.gov/stopransomware | head -10
cat > "$IR_LAB/scenarios/ransomware-named.txt" <<'EOF'
Ransomware IR literacy — NAMED (defensive only):
Indicators: mass file rename, ransom note, disabled backups, lateral movement
First actions: isolate segment (YOUR assets), preserve logs, notify IR lead + legal
CISA guidance: do not pay by default — consult legal/law enforcement
Recovery path: offline backups, rebuild, patch initial access
HARD BAN: ransomware builders; paying criminals how-to; decryptor marketplace steps
Lab: read CISA guide via curl — tabletop LAB-IR-RANSOM-001 only
EOFCommand — copy this
grep -E 'Indicators|HARD BAN|CISA|tabletop' "$IR_LAB/scenarios/ransomware-named.txt"
Primary tools to practice this lesson: grep, curl. Reference sites: CISA Stop Ransomware (https://www.cisa.gov/stopransomware); CISA ransomware guide (https://www.cisa.gov/stopransomware/ransomware-guide); NIST SP 800-61 (https://csrc.nist.gov/publications/detail/sp/800-61/rev-2/final). Run every command in the box — install first, then the usage lines — only on YOUR lab / program scope.
2. Defender vocabulary
Contain before negotiate category — policy decision literacy, not crime how-to.
Link Module 5 containment and Module 6 eradication rows on same scenario thread.
3. $IR_LAB boundary
Tabletop scenario cards on YOUR notes only — not payload authoring.
Refused: ransomware build guides, payment negotiation crime how-tos, prod encryption tests.
4. What you ship: ransomware scenario card
Impact + vectors + scope + response phase stub + NEVER payload creation line.
5. What you record before the next lesson
Ransomware scenario card path.
6. Wrong vs right: stranger networks vs YOUR IR tabletop
Worked failure — same MSF word, opposite target. Right never needs a café Wi-Fi or classmate laptop.
Wrong
Build encryptor payload in lab VM as 'realistic ransomware training.'
Right
Ransomware scenario card from `$IR_LAB` tabletop stub. Next: Tabletop Flow.
Mission: ransomware scenario card
1) Name five ransomware literacy rows. 2) Fictional org and labeled assets. 3) Link containment/eradication rows. 4) Write NEVER payload creation line.
Stuck? Ask Cyberlium AI Mentor
Ask Mentor: “Encryption vs extortion-only — literacy split?”
Knowledge Check
APPLY: Ransomware literacy on Cyberlium uses:
Multiple choice
Knowledge Check
APPLY: True or False: Building encryptor payloads is course lab.
True or False
Knowledge Check
APPLY: Ransomware scenario card includes:
Multiple choice