• 14 min read
TOPICS: Cybersecurity / Security Fundamentals / Threat Landscape
Morning Brew Design
Morning Brew Design
Every decision counts.
Every choice has consequences.
Navigate four critical nodes of this cyber crisis and see if you have what it takes to survive a modern ransomware attack.
08:42 AM in the security operations center (SOC).
The hum of server fans. The smell of ozone. And soon, the taste of panic.
You are the new CISO of a major software company. You haven’t even finished your first coffee when the SOC’s silence is shattered. It starts with one ticket from an employee locked out of the system. Then ten.
Then the main dashboard bleeds red. Login failures are cascading across the network.
Your sysadmin points to a text:
We have encrypted your systems. Pay $20M in Bitcoin or we will leak your data.
Your pulse spikes. Ransomware attacks on organizations have become endemic in recent years. You are now a statistic.
You are not alone in this situation, with ransomware a common attack against organizations.
// According to Paul Caiazzo, chief threat officer at Quorum Cyber, ransomware is “the most salient, pressing threat” organizations face today. And Rishika Desai, a threat researcher and technical writer at BforeAI, says it affects “everybody, left, right, and center,” regardless of size.
What should you do first?
SELECT YOUR RESPONSE
The initial attack is contained, but the clock is ticking. The Board is demanding a timeline for restoration. However, your team doesn't know how the attackers got in.
// Mike Puglia, general manager of cybersecurity labs at Kaseya, describes this dynamic as “Whac-a-Mole, or a game of cat and mouse, between defenders and attackers, and as soon as one hole is closed, suddenly the next wave comes.”
How do you prioritize your recovery strategy?
SELECT YOUR RESPONSE
A cautious approach. It is vital to understand the attack, but when communication halts, chaos increases. You must ensure roles are defined.
Because you opted to engage with the threat actors to pay the ransom, you have entered the negotiation phase. The attackers have opened a portal on the dark web, complete with a surprisingly professional chat interface and a ticking countdown timer. They are offering a “test decryption” of three non-essential files to prove they hold the passkeys.
// Handling this delicate conversation requires understanding how a ransomware attacker thinks—they view this as a business transaction, not a personal vendetta.
Who do you put in charge of the negotiation chat?
SELECT YOUR RESPONSE
A wise choice. Professional negotiators know the exact cadence and language to use. They can verify that the decryptor actually works without antagonizing the attackers and, often, lower the ransom demand.
The attack isn’t over yet. The attackers have stolen your data and are threatening to leak it.
// This is a “double extortion” tactic: Your most sensitive information is encrypted and potentially in the open. You need to decide how to handle this new demand, adding more pressure to the worst week of your professional life.
What do you do now?
SELECT YOUR RESPONSE
The smartest route for a payer. You leveraged professionals who know the specific criminal groups.
// “It is worth bringing them on and into your incident response, because that’s what they do all day—they know the different groups,” said Mike Puglia, general manager of cybersecurity labs at Kaseya. “They have a history of how to do it, and what to handle.”
Because of your previous aggressive or reckless decisions, the threat actors have lost patience. They skip the private extortion demands and dump a 50GB sample of your customer data onto the dark web. Worse, they tip off a major tech journalist.
The reporter calls your office, asking for a comment on the leaked databases. You now have a massive communications crisis on your hands.
How do you communicate during this ransomware leak?
SELECT YOUR RESPONSE
The worst possible move from a PR perspective. The media fills the silence with speculation, and your customers panic. Trust has evaporated, along perhaps with at least some customers, a chunk of future revenue, and, if you’re publicly traded, your stock price.
Six months have passed. The immediate crisis is over, but the threat landscape has evolved. Attackers are using software-as-a-service (SaaS) models and outsourcing to third-party vendors who charge for their services.
// “The good news, of course, is that our customers are getting smarter about responding. So, it’s a back-and-forth,” said Chris Hendricks, head of incident response at Coalition.
What is your long-term strategy to win this “back and forth”?
SELECT YOUR RESPONSE
Viable. The best-prepared enterprises do the homework months in advance.
// “They’ll have realized, if they’re doing…tabletop exercises, that they need to ensure that, first off, technical controls like backups have been implemented robustly and are available for recovery, should they need them in the event [of] ransom impact,” Quorum Cyber Chief Threat Officer Paul Caiazzo said.
Six months have passed since the incident. Because you chose to play fast and loose—either by draining company coffers or trying to “hack back”—word has spread on dark web forums that your organization is a lucrative, reckless target. A new gang targets you.
This time, they don’t even bother deploying complicated encryption software to lock your files. Knowing you will panic, they just use stolen credentials to silently exfiltrate another massive batch of data and hold it for ransom.
// Even ransomware actors tire of complicated encryption when pure extortion works just as well.
How do you handle an extortion-only attack?
SELECT YOUR RESPONSE
A painful but necessary course correction. By refusing to pay, you stop the cycle of being viewed as an “easy mark.” Implementing zero trust limits lateral movement, stopping future data theft dead in its tracks.
Threat neutralized
You navigated the crisis with precision. By prioritizing early detection, utilizing expert negotiators, and maintaining transparent communication with stakeholders, you followed the advice of industry leaders. You recognized that ransomware is a business, and you managed the risk without destroying your own.
Actionable advice for IT pros:
// Read more on IT Brew:
At a cost
IT BREW CYOA 2026
Data Source:
IT Brew (Interviews with Quorum Cyber, Sophos, Kaseya, Coalition, etc.)
Disclaimer:
The following interactive game uses real reporting to contextualize a fictional cyberattack scenario. Any resemblance in this game to actual events is coincidental. What follows is not intended in any way as legal advice from IT Brew or Morning Brew Inc. Victims of a real-world cyberattack should immediately consult the relevant legal authorities.
This is a good strategic move. Early detection and isolation is critical to stopping a bad actor from accessing a more important system after they find access.
// Google recently announced AI-powered traps specifically designed to catch rapid file changes and “stop the sync” immediately.
This is a risky precedent to set. While it might be cheaper than ceasing operations, you are fueling the cybercrime industry.
// “From a research perspective, and from people who don’t want these crimes to continue, we know that paying them helps them continue the work,” said Alex Rose, the global head of government partnerships and the counter threat unit team at Sophos. “That’s why they’re in the business of what they’re in, they want to make money. Some people would say [it] incentivizes them to continue their work and so on.”
This is the standard playbook for the insured. Providers typically have response teams on contract.
// The goal is to get the organization out of the ransom situation as soon as possible, said Mike Hamilton, former field CISO for cybersecurity solution provider Lumifi and current chief technology officer for PISCES International.
A critical misstep. You aren’t dealing with amateurs; you are facing down professionals.
// “This isn’t just a slapdash set up; this is big money and big organization and a lot of people, and as they get better at running their nefarious business, it means a faster impact on the side of our customers,” said Chris Hendricks, head of incident response at Coalition.
// “We always talk to organizations about having an incident response plan, but also exercising that plan,” Alex Rose, global head of government partnerships and CTU from Sophos, said. “I think it’s really important that people know their roles and responsibilities and that you communicate. Because…[when] you don’t communicate, people fill that vacuum with whatever they’re thinking and try to do that both internally and externally.”
Prevention isn’t always possible, so detection is key. By using EDR to monitor critical assets, you catch the actor doing reconnaissance.
// “The key there is to have monitoring of systems, which is where [endpoint detect and response] comes in, of what’s actually happening on a critical asset like a server or an appliance that’s out on the internet,” said Sophos Principal Threat Researcher Keith Jarvis. “Maybe the threat actor can successfully exploit that and land on that system and start to do the reconnaissance and post-intrusion type activity that we expect, but a lot of that stuff is going to then raise flags.”
Risky. While backups are essential (ideally the 3-2-1 method), simply restoring them without fixing the vulnerability or monitoring for persistence is dangerous.
// Searchlight Cyber reported that “improved backup and restoration capabilities” are driving attackers toward extortion rather than just encryption. “There’s not a bigger, more disruptive cybersecurity threat that your average organization is going to face,” said Paul Caiazzo, chief threat officer at Quorum Cyber. “There are some organizations that may be more concerned about espionage-related adversaries or attacks, but the ransomware scourge is so prolific that [it] doesn’t matter what size organization you are, whether or not you think you’re a target—you are a target, even opportunistically.”
A terrible error. Executives often bring emotion into a space where threat actors only care about leverage and payment in cryptocurrency (which is often the type of money demanded during ransomware attacks). The CEO’s aggressive demands offend the attackers, who immediately double the ransom price to prove a point.
A dangerous game. Ransomware actors do this every day. They know when a victim is stalling. Realizing you are trying to bypass them, the attackers decide to abandon the negotiation and decide to punish you instead.
A desperate error. You cannot trust criminals to honor a data deletion agreement.
// “With data theft, I cannot prove that the threat actor is going to not continue to leak the data, and so that’s why I tend to not recommend people pay ransoms—if it’s purely just to suppress a data leak, because you simply can’t trust what the threat actor is telling you in those moments,” said Paul Caiazzo, chief threat officer for Quorum Cyber.
Brave choice. Timely updates provide momentum and confidence.
// “There can be different phases to that. For example, in some companies, what I have seen is they set up a dedicated page and they give their timely updates,” said Rishika Desai, a threat researcher and technical writer for BforeAI. “You can give [stakeholders] timely updates as and when it’s necessary. At least it gives a confidence to the stakeholder that there is some momentum going on in mitigating the damage that has been caused.”
Illegal and chaotic. Employees going rogue and launching their own ad-hoc cyberattacks adds confusion to an already tumultuous situation. And that’s before you consider how your attackers can likely continue to monitor your moves.
// “The big concern we have is, even if you can use some of your comm systems, it’s understanding what’s compromised…because you also don’t want to be coordinating your plan on a system that they’re able to monitor,” said Alex Rose, global head of government partnerships and the CTU at Sophos.
The correct approach. A holding statement buys you time to do forensics without lying to the public. It satisfies regulatory bodies and manages the narrative while your team works the problem.
A potentially criminal mistake. Lying to the public and investors about a material data breach will trigger immediate SEC investigations and class-action lawsuits once the truth inevitably comes out.
Illegal and chaotic. Employees going rogue and launching their own ad-hoc cyberattacks adds confusion to an already tumultuous situation. And that’s before you consider how your attackers can likely continue to monitor your moves.
// “The big concern we have is, even if you can use some of your comm systems, it’s understanding what’s compromised…because you also don’t want to be coordinating your plan on a system that they’re able to monitor,” said Alex Rose, global head of government partnerships and the CTU at Sophos.
Passive. Insurance is vital, but relying only on payout mechanisms won’t stop the disruption. Attackers are motivated by profit.
// “These criminal gangs are not just doing this because it’s fun. They’re doing this because it’s very, very profitable, and there is very little law enforcement and very little risk for them being involved,” said Maël Le Touz, senior threat researcher at Infoblox.
Counter-productive. Instability and lack of communication are the enemies during an attack. Creating a culture of fear prevents people from doing their jobs effectively.
A fatal error. You have established a permanent subscription to being extorted and will be targeted repeatedly until the company is bankrupt.
Foolish. You are effectively just paying the ransom with extra steps and less legal protection, while still funding the exact criminals who attacked you.
You survived, but at a price. Whether by paying ransoms without insurance or failing to plan via tabletop exercises, you suffered significant disruption. A targeted organization that doesn’t have the backups or the cash to pay a ransom risks going out of business. You paid, but the cost was even steeper.
Actionable advice for IT pros:
// Read more on IT Brew:
Total system collapse
Your decisions accelerated the damage. By failing to communicate clearly or trusting criminals to delete stolen data, you fell into a bad trap. The board has asked for your resignation.
Actionable advice for IT pros:
// Read more on IT Brew:
