Cyber Incident Response
When an organization is compromised, the first decisions shape everything that follows: what evidence survives, how long the adversary remains, what must be disclosed, and what recovery costs. Acervus provides incident response led by practitioners with years of experience in malware reverse engineering and analysis, and deep knowledge of nation-state operations and ransomware campaigns. Our objective is not only to understand the intrusion, but to direct the complete removal of the threat actor from the client's networks and systems, and to confirm they stay out.
01Where handling it alone breaks down
- Evidence is lost in the first hours. Rebooting, reimaging, or wiping systems to restore service destroys the forensic record needed to understand what happened.
- The scope is underestimated. Visible damage is rarely where the intrusion began. Without analysis, organizations remove one foothold while the adversary keeps others.
- Reinfection follows recovery. Systems restored before the access path and persistence mechanisms are identified are often compromised again.
- Deadlines start immediately. Contractual, regulatory, and insurer notification windows can begin at discovery, sometimes within 72 hours, while the facts are still unclear.
- Ransom decisions carry legal risk. Payments can raise sanctions and law enforcement considerations that organizations are rarely equipped to assess under pressure.
- Internal teams are stretched. IT staff must keep operations running while investigating an adversary that has studied their environment.
02The Acervus approach
| Phase | What we do |
|---|---|
| Triage | Establish what is known, preserve volatile evidence, and set priorities with leadership and counsel |
| Containment | Advise on isolating affected systems and accounts without destroying evidence |
| Investigation | Forensic analysis to determine initial access, lateral movement, persistence, and data affected |
| Malware analysis | Reverse engineering of malicious code to understand capability, communication, and indicators |
| Threat context | Assessment of the activity against known nation-state and ransomware tradecraft |
| Eradication and recovery | A detailed eradication plan, and step-by-step direction to the client's IT staff as they remove the threat actor's access, persistence, and tooling, followed by verified, safe restoration |
| Reporting | Executive summary, technical findings, and a factual record prepared for counsel |
03Eradication: removing the threat actor
Sophisticated adversaries, particularly nation-state groups and established ransomware operators, rarely depend on a single point of access. Removing one compromised account or one infected server leaves the rest of their foothold in place, and alerts them that they have been discovered. Eradication succeeds only when it is complete and executed at once.
Eradication is carried out by the client's IT staff, following Acervus's plan and direction at each step. In some cases, and by arrangement, Acervus may also support remediation procedures on-site or remotely.
- Map the full foothold first. Identify every compromised account, credential, host, and persistence mechanism, including backdoors, scheduled tasks, rogue accounts, remote access tools, and cloud and identity-provider footholds, before taking action.
- Remove access in a single coordinated action. Revoke credentials and sessions, remove malicious code and persistence, and close the initial access path together, so the adversary cannot use one foothold to restore another.
- Reset trust. Rotate privileged credentials, keys, and secrets the adversary may have obtained, including identity infrastructure where it was compromised.
- Harden the path back in. Close the vulnerabilities and configuration weaknesses the adversary used, so the same technique does not work twice.
- Verify they are gone. Monitor the environment after eradication for signs of returning activity, using the indicators identified during malware analysis, before declaring the incident closed.
04Coordination
Engagements are structured to work alongside the client's outside counsel, cyber insurer, and law enforcement when the client chooses to involve them. Where privilege is a consideration, work can be performed at the direction of counsel.
05Scope and limitations
- Remediation and eradication are performed by the client's IT staff under Acervus's direction. Hands-on remediation support from Acervus, on-site or remote, is available in some cases by arrangement.
- Acervus accepts new incident response clients on a case-by-case basis, subject to current engagement commitments.
- Acervus does not make ransom payments on a client's behalf.
- Findings reflect the evidence available during the engagement.
- First Hour of a Cyber Incident checklist Open, no form.
- Case study: NotPetya and Maersk (2017) From public reporting, not client work.
06Report an active incident
No pricing appears on this page; engagements are scoped individually. If you are responding to an active incident, use the urgent request form below. Do not include sensitive details; we will establish a secure channel.
For other requests, see Request an Engagement.