Solutions
Ransomware solutions
Response plans organized by the system that was encrypted and by industry. Each one covers the typical symptoms, the recovery paths available and how to harden afterwards.
By scenario
Start from the system that was hit: databases, virtualization platforms, NAS, backups and business applications.
- Microsoft SQL Server
Database Encrypted by Ransomware
When database files are encrypted, every business system that depends on them stops at once. This page explains how we triage an encrypted database, how recoverability is assessed, and when file repair, backup-plus-log restore, or rebuild is the right path.
- Microsoft SQL Server
SQL Server Database Encrypted by Ransomware
When SQL Server .mdf / .ldf files are encrypted, the ERP and inventory systems built on them — Yonyou U8, Kingdee K/3, Guanjiapo, Suda — stop completely. This page covers evidence handling, how we judge whether page-level repair is viable, and the conditions for backup-plus-log restore.
- Oracle Database
Oracle Database Encrypted by Ransomware
When Oracle datafiles (.dbf), control files and archived redo logs are encrypted, hospital HIS, large ERP and group finance systems typically go down as a whole. This page covers triage order, the role of control files and archived logs, and when block-level repair or RMAN restore applies.
- MySQL
MySQL / MariaDB Database Encrypted by Ransomware
When MySQL's ibdata1, .ibd and .frm files are encrypted, websites, online stores, OA and other web workloads all go down. Most cases start at a web application flaw or an exposed management panel. This page covers what InnoDB's file layout means for recovery, the value of binlogs, and the correct sequence.
- VMware ESXi
ESXi / Hyper-V Virtualization Encrypted by Ransomware
Hypervisor-level encryption causes the widest blast radius of any ransomware event: dozens of production VMs go dark within an hour or two. This page covers what Linux ESXi encryptors actually do — shut down guests, encrypt vmdk, delete snapshots — the recovery value of flat disk files, and how Hyper-V and Proxmox cases differ.
- Windows Server 文件服务
File Servers and NAS Encrypted by Ransomware
When shared folders on a file server or NAS are encrypted, drawings, contracts, archives, quotations and design sources all become unusable at once — and mapped drives spread the impact to every endpoint. This page covers how to gauge spread, what shadow copies and snapshots realistically offer, and how to sequence recovery by business value.
- Synology DSM
Synology NAS Encrypted by Ransomware
Synology incidents come in two shapes: the NAS itself is compromised (DSM exposed to the internet, accounts brute-forced), or an infected Windows host on the LAN encrypts it over SMB. The handling and recovery paths differ completely. This page explains how to tell them apart and what Btrfs snapshots and Hyper Backup can actually do.
- QNAP QTS / QuTS hero
QNAP NAS Encrypted by Ransomware
QNAP is among the NAS brands most frequently targeted by ransomware, with DeadBolt, Qlocker, eCh0raix and Checkmate all publicly documented — all sharing one precondition: internet-exposed devices. This page covers what each looked like, how to identify which case you have, and what snapshots and backups can do.
- Veeam Backup & Replication
Backups Deleted or Destroyed
Modern ransomware follows a fixed sequence: destroy the backups, then encrypt the data — deleting shadow copies, encrypting repositories, disabling jobs, and exploiting backup software flaws to steal credentials. This page covers what can still be inventoried once backups fail, why replication propagates encrypted files off-site, and what offline and immutable copies are really worth.
- 用友 U8 / NC / 畅捷通 T+
ERP System Encrypted by Ransomware
An encrypted ERP is not a single broken database: the application tier, database, attachments and interfaces fail together, halting finance, procurement, production and inventory. This page covers the vulnerability entry points seen in Chinese ERP deployments, the order in which the four tiers are recovered, and how account sets are reconciled at sign-off.
- 泛微 e-cology / e-office
OA Collaboration System Encrypted by Ransomware
An encrypted OA system halts document circulation, approvals, contract archives, HR and knowledge bases at once — and because OA is so often published to the internet, it is frequently the attacker's first foothold. This page covers its vulnerability profile, the twin-track recovery of attachments and database, and how to check for lateral spread.
- Active Directory 域控制器
Domain Controller Compromise and Estate-Wide Encryption
A compromised domain controller hands the attacker a legitimate administrator identity, allowing an encryptor to be pushed to every host at once through Group Policy or remote execution. This page covers how such incidents present, the correct order for Active Directory recovery, and how to decide between cleanup and full rebuild.
By industry
Recovery priorities and response paths shaped around each industry's critical systems and compliance requirements.
Manufacturing Ransomware Response and Recovery
Ransomware in manufacturing hits information systems and production cadence at the same time: with ERP down there are no orders, with MES down there is no schedule, and an encrypted drawing library takes the process documentation for an entire product line with it. This page covers the asset profile, recovery priorities and targeted defences.
Healthcare Ransomware Response and Recovery
When a hospital is hit, registration, consultation, orders, billing, laboratory and imaging fail at the same moment and care falls back to paper. This page covers the healthcare threat picture, a recovery priority built around clinical continuity, and the handling of patient data and compliance obligations.
Government and Public Sector Ransomware Response
Public sector ransomware incidents run on three lines at once: service interruption, data security and mandatory reporting. When document circulation, archives and integrated service platforms stop, both public services and internal operations are affected. This page covers the handling sequence, reporting duties and hardening priorities.
Education and Research Ransomware Response
Schools and research institutions run open networks with dispersed endpoints and systems built across many eras, often unattended at night and during holidays — a combination attackers exploit. This page covers the sector's threat profile, recovery priorities for academic and research data, and defences suited to campus networks.
Financial Services Ransomware Response and Recovery
Financial and quasi-financial institutions face far stricter requirements on data integrity, transaction continuity and regulatory reporting than most sectors, so one ransomware event hits availability, customer trust and compliance simultaneously. This page covers the threat profile, a recovery approach centred on transactional consistency, and hardening priorities.
Retail and E-commerce Ransomware Response
In retail and e-commerce, ransomware translates directly into an inability to sell: order systems, membership, POS and warehouse fulfilment stop together and losses accrue by the hour. This page covers the sector's attack patterns, a recovery order built around the order-to-fulfilment chain, and handling of member data exposure.
Logistics and Supply Chain Ransomware Response
Logistics is acutely time-sensitive: when TMS, WMS, dispatch and sorting systems stop, goods pile up in warehouses and on routes immediately, and the effect propagates up and down the supply chain. This page covers the sector's threat profile, a recovery order built around goods movement, and hardening for EDI-interconnected environments.
Construction and Real Estate Ransomware Response
In construction and real estate the core assets are drawings, models and project documentation — typically scattered across project-site NAS units, shared drives and personal computers with no unified backup. This page covers the sector's threat profile, recovery of drawings and BIM models, and defences for dispersed, multi-project environments.
Gaming & Interactive Entertainment
A ransomware event at a game company usually runs on two separate loss tracks: the outage — account, top-up and leaderboard databases encrypted, with churn and refunds accruing by the hour — and double extortion over stolen source code, unreleased content and art assets. This page covers the typical entry points across live-ops and development environments, a recovery order built on data consistency and repository integrity, and how staged relaunch and exfiltration assessment are handled.
Blockchain & Crypto
For blockchain firms, exchanges and custodians, mining operations and node providers, the attack surface sits almost entirely off-chain: nodes, index databases, KYC records and signing hosts are what actually get hit. This page covers the threat paths, a recovery approach built around key-custody audit and on-chain/off-chain reconciliation, and hardening priorities.