Recently 16-year prison sentence was handed to Maksim Silnikau, creator and administrator of the Ransom Cartel ransomware operation. This was a significant law-enforcement outcome. His arrest disrupted the group, while his prosecution removed an experienced operator who had spent years building ransomware infrastructure and recruiting participants.
For businesses, its more consequential lesson note that, the said Ransom Cartel had attacked at least 18 organisations between 2021 and 2023. Its operating model was highly organised, separating those building and administering the ransomware operation from affiliates carrying out intrusions. Participants could obtain compromised access, encryption tools and infrastructure for managing attacks, negotiating with victims and distributing criminal proceeds.
This sentence could weaken one criminal operation, but it does little to change the underlying economics that make ransomware possible.
Ransomware attacks has become less dependent on a single attacker, malware strain or criminal group. Access can be obtained separately, attacks can be executed by affiliates, and data can be stolen before systems are encrypted.
That changes the question companies should be asking.
Preventing ransomware remains necessary. The harder question is whether the business can continue operating when prevention fails, with the confirmation that their data is not extracted and still inside the organisation.
Let’s take another contrasting case, a recent cyberattack on French rugby club Stade Français. The club restored its IT environment from clean backups and continued normal operations. Its ticketing platform and online store remained operational.
Yet recovery did not end the incident.
Data allegedly stolen during the attack appeared online, forcing the organisation to investigate the breach, determine whose information may have been affected, engage authorities and manage communications with stakeholders.
The paradox is clear: An organisation can restore its systems and still remain inside the crisis.
That distinction should shape how boards and management teams assess ransomware readiness.
Traditional ransomware discussions often focus on endpoint controls, patching, detection and backups. Those measures matter. They do not establish whether the enterprise can sustain critical business operations while technology teams investigate, isolate and rebuild compromised systems.
The immediate challenge is operational continuity.
Management needs to know which business services must continue, which systems can be taken offline, what manual alternatives are viable, which dependencies must be restored first and how long the organisation can tolerate degraded operations.
Those decisions cannot be developed for the first time during an attack.
The another issue is recovery confidence.
A backup is an asset. A tested ability to restore the business from a trusted state which is evidence of resilience.
CERT-In's ransomware guidance emphasises eliminating previous vulnerabilities and threats and restoring from backups or restore points that are verified as infection-free.
Recovery confidence therefore depends on more than backup-success percentages. It depends on tested recovery sequences, trusted identities and privileged accounts, appropriate system rebuilds, understood application dependencies, usable recovered data and clearly established recovery priorities.
If you technically successful restore and you still have the attacker back into the environment, This is not recovery.
Boards should therefore be cautious while strategizing ransomware-readiness reporting just based largely on technical activity. Patch rates, endpoint coverage and backup percentages are useful, but they do not answer the more consequential question:
How much & which business can the organisation continue if its primary technology environment becomes unavailable?
Indian financial-sector regulation increasingly reflects this reality. RBI requires regulated entities to address business continuity, cybersecurity, incident response, recovery and cyber-crisis management, including testing communication processes and periodically restoring backed-up data. SEBI and IRDAI similarly maintain formal cybersecurity and resilience requirements for regulated entities.
For pharma and manufacturing organisations, the regulatory structure differs, but the operational problem remains. CERT-In's directions also establish incident-reporting requirements for specified cyber incidents.
This makes ransomware readiness an enterprise responsibility, particularly across BFSI, insurance, pharma and manufacturing.
Boards need assurance that management understands how a ransomware incident can become a business interruption, this evidence ideally come from practising realistic scenarios under pressure & how the enterprise can ABSORB the attack.
For leadership teams, the conversation can begin with one question:
If ransomware disabled a critical part of the organisation tonight, what evidence gives the board confidence that the business could continue tomorrow?
This is the perspective I bring to my work with boards, executive teams and security leaders. Through ransomware-readiness assessments, executive cyber exercises and incident-governance reviews, I focus on whether organisations can continue operating, recover from a trusted state and make sound decisions under pressure.
For me, ransomware readiness is not about having more technology on paper. It is about having the confidence, evidence and organisational preparedness to respond when that technology is tested.
(Authored By Bharat Ajay C Bhayani, Cyber Resilience Strategist, Director AmbiSure Tecnologies Pvt Ltd.)
