Walk a ransomware response

Result: FAIL · 10/100

Pass needs 70 and every critical gate. Gates grade the whole response, so finish before reading them.

• Fail · Contain before the file server is encrypted (critical)
  Encrypted: sp-01, fs-01, ws-114, ws-207, bkp-01
  Ransomware damage scales with every minute of spread; isolating the beachhead is the first CISA response step.
• Fail · Isolate the network; don't power off before capturing memory
  sp-01 never isolated
  CISA advises disconnecting rather than powering down: keys and the attacker's tooling live in memory.
• Fail · Protect backups before the attacker stops them
  Backups never locked
  Operators delete shadow copies and disable backups before encrypting so victims can't recover without paying.
• Fail · Restore from a clean point that predates the intrusion (critical)
  No restore
  A point taken after initial access still carries the web shell; only a pre-intrusion, attacker-unreachable copy is trustworthy.
• Fail · Reset credentials and patch the entry before reconnecting
  Never reconnected
  Dumped credentials and the unpatched SharePoint entry let the operator walk straight back in.
• Fail · Notify legal and report to CISA/FBI
  No report
  Reporting is part of the CISA checklist and often a legal or insurance obligation.
• Pass · No ransom paid (critical)
  Not paid
  Payment funds the operator, guarantees nothing, and here a clean restore was available.