There is a ransom note on the screen, and it names an amount to pay.

What the FBI says

The FBI’s ransomware page states that the FBI does not support paying a ransom in response to a ransomware attack. It gives two reasons: payment is no assurance that you will recover your files, and it encourages the people behind the attack to target more victims.

That is the FBI’s position. It does not decide the question for you, and it does not remove the pressure of locked computers on a working day. It is the starting point for the conversation with your insurer and your attorney, not the end of it.

The Treasury question: who is on the other end

In its updated ransomware advisory (September 21, 2021), the Treasury Department’s Office of Foreign Assets Control (OFAC) says the U.S. government strongly discourages paying ransoms. It adds that a payment to a person or place under U.S. sanctions may violate OFAC regulations, and that civil penalties can be imposed on a strict-liability basis, meaning even if the payer did not know or have reason to know the transaction was prohibited.

The same advisory treats a self-initiated and complete report to law enforcement or CISA, made as soon as possible after discovery, and ongoing cooperation afterward, as significant mitigating factors. You usually cannot tell from a ransom note who is behind it. Whether a particular payment touches sanctions is a question for an attorney, and in practice it is usually raised through your insurer.

What to send to the IC3

The FBI asks victims to file a detailed complaint at ic3.gov, with every required field complete. Copy these from the note and the screen before anything is deleted:

• The name of the ransomware variant, if the note gives one.
• The file extension the encrypted files now carry (for example, whatever new letters follow the original file name).
• The cryptocurrency type and wallet address in the note.
• Any email address the attackers used.
• Any website or URL the attackers supplied.
• The ransom amount demanded.
• Whether a ransom was paid, and the amount if it was.

Ask about a decryption tool before you assume there isn’t one

CISA’s ransomware guide tells victims to ask federal law enforcement about possible decryptors, even when other recovery looks possible, because researchers sometimes find flaws in the encryption of particular variants. The variant name and file extension you collected above are what make that question answerable.

Before anyone replies to the attackers

1. Photograph the note on the screen with a phone, including the date and time shown on the computer. Do not close or delete it yet.
2. Take the affected computers off the network by unplugging the network cable or turning off Wi-Fi. CISA lists powering off as a fallback, because it loses what is held in memory.
3. Use the telephone, not email or chat on the affected network, to reach your IT provider, your insurer, and your attorney. CISA recommends phone calls so the attackers are not tipped off while you isolate systems.
4. File the report at ic3.gov, and consider contacting your local FBI field office or CISA at cisa.gov/report.
5. Ask your insurer and your attorney what they need before any payment, any reply to the attackers, or any public statement.

What a payment does not do

CISA’s guide tells responders to identify the dropper malware before rebuilding from backups, so the compromise does not continue. The same reasoning applies after a payment: getting files back and finding out what let the attacker in are two separate jobs, and the FBI’s page gives no assurance of either.

The decision to pay carries legal, insurance, and recovery questions that are easier to answer with your attorney, your insurer, and a report to the FBI already in hand than from the deadline in a ransom note.

Related

• Ransomware After the First Hour: Scope, Restore, Evidence
• Who to Tell After a Security Incident, and in What Order
• Cyber Insurance Claim: What to Do Before You Call Anyone
• Keeping Evidence Before You Clean Up a Computer

Sources

• FBI Internet Crime Complaint Center: Ransomware
• CISA: #StopRansomware Guide
• CISA: I’ve Been Hit by Ransomware
• U.S. Treasury OFAC: Updated Advisory on Potential Sanctions Risks for Facilitating Ransomware Payments (September 21, 2021)
• U.S. Treasury OFAC: Recent Actions, September 21, 2021