Forensically Sound Ransomware and BEC Incident Response

Facing a ransomware attack or business email compromise?

NSI Global provides incident triage, forensic acquisition and analysis, scoping and support for containment and recovery decisions following ransomware and business email compromise incidents. Response priorities are agreed with the client’s technical, legal, insurance and executive stakeholders.

Examination can identify available evidence of initial access, persistence, lateral movement, mailbox manipulation, data access and encryption activity, subject to the logs and artefacts available. NSI Global preserves available evidence under documented chain-of-custody procedures, reconstructs relevant activity and reports confirmed findings, limitations and prioritised remediation actions.

Reports distinguish observed evidence, analytical assessment and unresolved questions for technical teams, executives and legal advisers.

Our Incident Response Capabilities

Ransomware Forensic Analysis

Examine available evidence of the encryption activity, initial-access path, persistence mechanisms and attacker movement across affected systems.

Business Email Compromise Response

Examine mailbox audit logs, forwarding and inbox rules, authentication events, phishing artefacts and user activity to establish the available evidence of compromise.

Forensic Imaging & Log Analysis

Capture and analyse endpoint and network artefacts to reconstruct attacker behaviour and establish a clear timeline of events.

Threat Actor TTP Analysis

Compare observed behaviour with publicly documented tactics, techniques and procedures and map supported findings to MITRE ATT&CK. Any association with a named actor or group is expressed with stated confidence and limitations.

Why Our Approach is Different

We specialise in ransomware investigations, BEC, and complex DFIR – not generic incident response.
Chain of custody is maintained for legal, regulatory, and insurance claims.
Incident handling can be mapped to NIST SP 800-61 Revision 3, with supported threat activity mapped to MITRE ATT&CK.
Our reports are tailored for executives, boards, and legal proceedings – not just IT teams.

Prepare for the Next Attack

Recovery is only the first step. Strengthening your defences is critical.

Explore how our Adversary Emulation & Red Teaming and Cyber Posture Consulting services can help reduce the risk of repeat compromise and strengthen detection and response capabilities.

Facing an Active Incident?

Contact NSI Global’s DFIR team from a known-clean device and communication channel. Do not wipe, restart or materially alter affected systems unless required for immediate safety or directed under the incident-response plan.

Preparatory consultations can be held at NSI Global’s radio-shielded Parramatta office or through a client-approved Webex meeting.

1300 000 NSI (674)

Ransomware Incident Response & BEC Forensics