# Playbook: Ransomware / Hostile Access

**Triggers:** suspicious encryption, unknown admin sessions, altered repos, exfiltration indicators.  
**Tier:** L2 / I5 — treat as breach until proven otherwise.

## Steps

1. **Isolate** — disconnect affected hosts from network; disable compromised accounts; preserve VM/disk snapshots for evidence.
2. **Preserve evidence** — do not wipe logs; capture auth logs, k8s audit, Gitea/Forgejo access logs, firewall logs.
3. **Revoke credentials** — rotate all tokens/passwords that may be exposed: OpenBao, Stripe, API keys, backup tokens, Gitea/Forgejo admin, SSH certs.
4. **Assess backup integrity** — verify offsite backups (Nextcloud) were not deleted; check `.last-backup` stamps; assume on-node backups on compromised host are untrusted.
5. **Build clean environment** — new machines; fresh OS; Ansible from known-good Git refs. **Never restore into compromised host.**
6. **Restore known-good data** — from backups timestamped **before** compromise; age-decrypt from offsite only.
7. **Rotate all secrets** — full rotation, not selective; update OpenBao paths; re-issue `warden` certs.
8. **Force resets** — user sessions, MFA re-enrollment where applicable.
9. **Validate** — smoke tests; compare restored repos against known-good SHAs.
10. **Document** — State Hub progress event; `TestEvidence/` incident note; update `AssetRegister.yaml` if exposure changed posture.

## Do not

- Pay ransom without executive decision recorded.
- Restore production DB over live data without identifying last good point.
- Paste secrets into incident notes.

## References

`BackupPolicy.md` §8 · `RestoreRunbooks/01-full-server-loss.md` · `PanicSheet.md` §4