Ravindra BagaleCourses & study guides

39. Malware Threats

39.8 Incident Response for Malware + CERT-In Awareness

By Last updated:

IR lifecycle (short, CEH-friendly): Prepare → Detect → Contain → Eradicate → Recover → Lessons.

Malware-focused actions:

  1. Contain – isolate host (network pull / EDR isolate); reset shared passwords if credential theft suspected; disable VPN account
  2. Eradicate – remove persistence, clean or reimage (rootkit / ransomware often → reimage faster than prayer)
  3. Recover – restore from known-good backup; monitor for re-entry
  4. Report / assist – organisational IR plan; in India, awareness of CERT-In directions and cybercrime.gov.in / 1930 helpline themes for citizens and orgs (verify current obligations for your entity type – do not invent legal deadlines here)

Preserve evidence when needed (disk image, memory) before reimage if investigation / insurance requires – policy call.

Red team (attacker) does Blue team (defender) detects / stops
Quiet persistence + delayed ransomware 24×7 EDR + hunt IOCs; unusual auth after phish
Re-enters via same VPN user after weak reset Forced password reset + MFA revoke sessions; kill tokens
Hopes SME never calls IR / CERT channels Written IR contacts; retainer; CERT-In / cybercrime.gov.in awareness

Ravindra Bagale's Tip

In a panic, students run del /s and format the disk – the evidence is gone, and the insurance claim / police complaint becomes weak. Contain first, photograph the ransom note, note the time, call the IR lead. In interviews, state the IR order clearly (contain before eradicate).

Practice task

Scenario: Salman's PC at Raja-Rani Traders shows ransom note; file server share \\files\accounts partial encrypt. Write 10-step IR checklist (contain → who to call → backup integrity check → reimage → restore test → user password resets → lessons). No payment steps.

Real incident: LockBit (public reporting)

LockBit is a ransomware operation widely covered in law-enforcement and CERT public reporting (affiliates, leak sites, multi-sector victims). Details evolve with takedowns and rebuilds in the news – class lesson is pattern: initial access + privilege + backup destruction + extortion. Defence: EDR, MFA, tested offline backups, IR readiness. Source: public FBI/CISA / CERT advisories on LockBit (verify latest).

Project: Build it, hack it, fix it

Build: In YOUR host-only lab, prepare a disposable Windows (or Linux) VM for fictional Sahyadri Traders with documented weaknesses: (1) Windows Defender / ClamAV off or exclusions wide open, (2) USB autorun / easy execution from Downloads enabled mindset (or macro-friendly Office lab setting), (3) daily user is local admin, (4) important dummy files only inside VM C:\sahyadri_lab_data (never real data). Snapshot pre-weak. Hack (lab only – SAFE simulation): Use the official EICAR test file and/or a benign pseudo-malware script you write that creates a marker file C:\sahyadri_lab_data\FAKE_RANSOM_NOTE.txt and optionally a .marker_infected flag – do not encrypt, delete, or overwrite real files; do not download ransomware. Show that with weak controls the marker lands and (if Defender off) EICAR is not blocked. Fix: Enable Defender (Tamper protection) or clamav + sudo service clamd start on Linux; remove exclusions; disable autorun; demote user from admin; block macros from internet; create a backup copy offline / second VHD you unplug; document Controlled folder access if Windows. Re-verify: Re-drop EICAR – must be quarantined/detected; re-run pseudo-malware – blocked by ASR/EDR/AV or note what still needs allowlisting policy; capture Event Viewer / Windows Security history or clamscan output in your report for owner Rani. No internet targets, no real malware binaries.