Your Business Is Under Attack Call Petronella Right Now
If ransomware just encrypted your files, an attacker is in your email, funds were just wired to a fraudulent account, or data is actively being stolen, stop reading and call us. Petronella Technology Group runs a Raleigh based incident response team with more than two decades of field experience in ransomware, business email compromise, crypto theft, and network breach containment.
What Counts As A Cyber Emergency Worth Calling A 24/7 Team At 3 AM?
Not every security scare is an active incident. These nine patterns, however, almost always require immediate professional containment.
If ransomware is actively encrypting files, a wire transfer was just misrouted, an attacker has live access to email, a wallet was just drained, or regulated data is visibly exposed, that is an emergency. Call immediately. The cost of waiting until business hours is almost always higher than the cost of the call. (919) 348-4912 rings to a responder.
If you are seeing any of the signs below, pick up the phone. Calling at three in the morning is a normal thing for us. Waiting until business hours can cost you the entire incident.
Active ransomware. Files on one or more machines have been renamed with an unfamiliar extension. A ransom note, usually a text file, HTML file, or desktop wallpaper change, is demanding payment in Bitcoin or Monero. Shared drives are starting to fail because the attacker is still actively encrypting data.
Business email compromise in motion. A client, vendor, or employee just reported an invoice that looks off, or payroll was rerouted, or a wire transfer went out to an account nobody recognizes. An inbox rule is silently forwarding executive mail to an unknown Gmail address.
Crypto wallet drained. Hardware wallet, exchange account, or custodial wallet just got emptied. Or a pig butchering or romance scam victim just realized the investment platform was fake and the funds are gone.
Unauthorized logins. Microsoft 365 or Google Workspace alerts show logins from Nigeria, Russia, or random VPN endpoints on admin or executive accounts. Multiple failed MFA pushes have been denied in the last hour, followed by a successful login.
Disclosure already happened. A dark web monitoring service, a customer, a journalist, or a federal agent reached out to tell you your data appears to be for sale. Someone posted your client list on a leak site.
Insider exfiltration. A terminated or departing employee has been running large downloads, plugging in unknown USB devices, or moving sensitive folders to personal cloud storage.
Regulated data exposure. Protected health information, controlled unclassified information, cardholder data, or personally identifiable information is visibly exposed on a misconfigured storage bucket, shared link, or public directory.
SCADA, ICS, or OT alarms. Industrial control systems are throwing alarms or acting outside normal setpoints. A manufacturing line or medical device network is behaving erratically.
Active phishing campaign against your customers. Your clients are getting emails that look like you, but are not you. Your domain is being spoofed, or a lookalike domain was just registered.
If the situation is ambiguous, call anyway. A short triage call costs nothing and tells you whether we need to mobilize or whether a simple fix will do the job tomorrow morning.
What Are The First Five Actions Before A 24/7 Responder Dials Back?
These five actions are safe for any incident class. Most small businesses can complete them in under ten minutes while a responder is dialing back to your number.
Isolate the device by pulling the network cable rather than powering off. Stop using the compromised device. Tell a senior person and loop in legal counsel and cyber insurance. Preserve all evidence. Call (919) 348-4912. These five actions are safe for any incident class and most organizations complete them in under ten minutes.
Isolate, do not power off. Unplug the network cable or kill Wi-Fi on the affected system.
Stop using the compromised device for anything. Do not log back in. Do not reboot.
Tell a senior person. Legal counsel and cyber insurance carrier must be looped in quickly.
Preserve evidence. Do not delete files, ransom notes, emails, or log entries.
Call Petronella Technology Group at (919) 348-4912. We will stay on the line.
Powering a ransomware machine off can destroy memory-resident evidence including the encryption key. Unplugging the network cable or disabling Wi-Fi is almost always the better move because it stops data exfiltration and further encryption while keeping the volatile state intact for forensic imaging. If the device is a laptop that has left the building, leave it running on battery and keep it in a safe place until we can collect it or walk your team through remote preservation.
Most cyber insurance policies require notification within a specific window, often twenty four or seventy two hours. Missing that window can void coverage. Pull out your policy, find the claims phone number, and call it even before you are sure what happened. Carriers are used to these calls and will not penalize you for a false alarm, but they will for a late notification.
What Does The First 24 Hours Of Incident Response Actually Look Like?
Here is how a typical engagement unfolds the first day Petronella Technology Group is on the clock.
Hour zero is triage and containment. Hours one through four are scoping, evidence capture, and scope validation. Hours four through twelve are eradication planning and parallel hardening. Hours twelve through twenty four are recovery staging, communication planning, and regulator or insurer notification where required. The exact sequence varies by incident class.
Hours 0 to 2, intake and scoping. A responder gets on a call or bridge with the decision maker and the on site IT contact. We identify affected systems, confirm which accounts are still trusted, agree on a secure out of band channel (usually Signal or a fresh Teams tenant), and stand up a locked down evidence repository. Your insurance carrier and breach counsel are usually on the bridge by the end of this window.
Hours 2 to 6, containment. We disable compromised accounts, kill active sessions, rotate credentials starting with the domain admin tier, force password resets, enable conditional access rules blocking unknown countries, and pull suspicious inbox forwarding rules. If ransomware is still active, we isolate affected network segments and hypervisors to stop further encryption.
Hours 6 to 12, forensic imaging. We image the affected endpoints, collect Microsoft 365 and Google Workspace unified audit logs, pull EDR telemetry, and preserve firewall, VPN, and RMM logs. Chain of custody documentation starts here in case law enforcement or a civil matter is likely.
Hours 12 to 24, preliminary findings. Initial timeline of compromise, likely initial access vector (phishing, exposed RDP, third party software, MFA fatigue, stolen session token), blast radius, and exfiltration indicators. First written status memo goes to counsel and carrier.
The first day is about stopping the bleeding and preserving evidence. Eradication, recovery, and post incident hardening happen over the following days and weeks depending on incident complexity.
What Happens In The First Seven Days Of A Ransomware Or BEC Incident?
Most mid market incidents are contained and fully recovered within seven to fourteen days. Here is what that looks like.
Week one is eradication, controlled recovery, forensic timeline work, and compliance-grade documentation. Systems come back online as they are validated, not all at once. Communication plans for employees, clients, and insurers are in motion. Legal counsel and breach coach coordination is active. Full recovery often extends past week one, but the critical path is set in days one through seven.
Days 2 and 3, eradication. Now that scope is understood, we remove attacker persistence. That includes scheduled tasks, run keys, WMI subscriptions, malicious service accounts, OAuth app grants in Microsoft 365 and Google Workspace, rogue inbox rules, and any new user accounts the attacker created. Tenant level secrets and API tokens are rotated.
Days 3 to 5, recovery. Clean systems are rebuilt from trusted backups or gold images. Encryption keys are recovered if a known strain is involved and decryptors exist. Mailboxes are restored from point in time backups where possible. Cloud data is restored from immutable snapshots.
Days 5 to 7, hardening and handback. We enable conditional access, MFA on every account, privileged identity management, tamper protection on the EDR, application allowlisting where the environment supports it, and offsite immutable backups. A formal incident report, with timeline, root cause analysis, IOCs, and recommended remediations, is delivered to counsel.
If regulated data was exposed, Petronella Technology Group supports your legal and compliance team with the breach risk assessment that drives HIPAA, state data breach notification, and sector specific (PCI DSS, FTC Safeguards, FAR 52.204-21, DFARS, CMMC) reporting decisions. We do not provide legal advice. We give your attorneys the factual evidence they need to advise you.
Incident Response Capabilities
Ransomware Response
Strain identification, negotiation support, decryption where public decryptors exist, backup restoration, and system rebuild. We do not facilitate ransom payments, but we help you, your carrier, and your counsel work with approved negotiators when payment is a legitimate option on the table.
Business Email Compromise
Microsoft 365 and Google Workspace forensics, wire recovery coordination, FBI IC3 filings, bank fraud team contacts, and kill chain reconstruction. If funds are already out, early filing with FBI IC3 at ic3.gov is the single highest leverage action.
Network Forensics
Packet capture analysis, firewall log reconstruction, VPN and RMM review, Active Directory audit, and lateral movement timeline. See our network forensics pillar for the full methodology.
Crypto Theft Tracing
Blockchain analysis of stolen funds, exchange coordination for freezing, and evidence packages that meet FBI IC3 and exchange compliance standards. See our crypto forensics pillar.
HIPAA Breach Response
Breach risk assessment, HHS notification support, OCR inquiry preparation, and patient notification content review. We do not draft legal notices, but we deliver the facts your counsel needs to do so correctly.
CMMC And DFARS Incident Reporting
If controlled unclassified information was exposed, the DoD DIBNet reporting window is seventy two hours. Our CMMC Registered Practitioners support the incident report filing and the post incident control review.
What We See Most Often In Emergency Calls
Most incidents trace back to a small number of initial access vectors. Recognizing the pattern early speeds up containment.
MFA fatigue and session token theft. An attacker has a valid password from a credential dump or phishing page, and then hammers the user with push notifications until they tap approve, or they use a modern phishing kit that steals the session cookie after legitimate sign in. Once inside Microsoft 365 they create inbox rules, grant an OAuth app consent, and start collecting invoices. Kill session tokens, rotate passwords, revoke OAuth grants, and enforce phishing resistant MFA on every account that can support it.
Exposed RDP or VPN. Remote Desktop on port 3389 open to the internet with a weak password is still how many small businesses get breached. Attackers use credential stuffing against SSL VPNs. Once they are in, they drop a remote access tool, disable endpoint protection, dump credentials with common tools, and kick off ransomware. Shut down internet exposed RDP, require MFA on every VPN session, and move to conditional access.
Third party software compromise. A managed services provider, a line of business application, an accounting add in, or a browser extension is the initial vector. The attacker uses the third party connection as a supply chain into multiple downstream customers. If your MSP was breached and you are a customer, assume your environment needs containment too.
Phishing to ransomware pipeline. The user opens a OneDrive link, the attacker harvests a session token, an EDR bypass loader is uploaded, attackers move laterally for days or weeks, and encryption happens late at night on a Friday or a long holiday weekend. Shortening the detection window from weeks to hours is the entire point of a modern managed detection and response service.
Social engineering at the help desk. The attacker calls your outsourced help desk pretending to be an executive, socially engineers a password reset or MFA re enrollment, and takes over the account. Train help desk staff on voice verification and out of band callback policies. Document who is allowed to approve what.
Retainer And Readiness Options
Most of our emergency callers never had a prior relationship with Petronella Technology Group. If you would rather not be cold calling a stranger at two in the morning, we also offer incident response readiness on a preplanned basis.
An incident response retainer gives you a preapproved hourly rate, a named lead responder, a scoped statement of work, and a set of on call contact paths so nothing needs to be negotiated during the crisis. We build an environment profile in advance so the first hour of an incident is not spent learning your stack. Most of our retainer customers also receive tabletop exercises twice a year, a short simulated phishing program, and a quarterly review of detection coverage against the MITRE ATT&CK framework.
If you are not ready for a full retainer, a one time readiness assessment is another option. Petronella Technology Group reviews your documentation, your backup strategy, your Microsoft 365 or Google Workspace configuration, your endpoint and firewall posture, and your legal and insurance contacts. You walk away with a prioritized gap list and the right phone numbers taped to the inside of your ops wiki. That alone often cuts hours out of real incident response.
Cyber insurance carriers increasingly favor, and in some cases require, a preexisting relationship with an approved incident response firm. Check with your broker. If Petronella Technology Group is not on your panel, a simple conversation between your carrier and our partnerships team can often get that added before your next renewal.
Organizations That Call Us
Honest Scope, No Surprises
Before you call, here is what Petronella Technology Group does not offer. Being upfront here saves everyone time.
We are not a licensed private investigator firm. Our forensic work focuses on computer, network, email, and blockchain evidence, not physical surveillance, process service, or mobile device imaging on family law or custody matters. We do not operate Cellebrite, Encase, or similar mobile forensic extraction platforms. If your matter requires those tools, we will refer you to a trusted partner.
We are not attorneys. We work closely with breach counsel, cyber insurance panel firms, and your outside lawyers, but we do not give legal advice. Anything that touches regulatory notification, contract language, or law enforcement cooperation runs through your attorney.
We are not licensed mental health professionals. Extortion, stalking, and personal account compromise cases are traumatic. If you need therapy referrals, we will help you find them, but our scope is the technical containment.
Crypto recovery is not guaranteed. Anyone promising guaranteed recovery of stolen cryptocurrency is a secondary scam. We trace, we coordinate with exchanges and law enforcement, and we give you honest probability estimates. Recovery rates depend on blockchain choice, time elapsed, and whether funds landed on a regulated exchange.
Emergency Response Questions
How fast can Petronella Technology Group respond?
Remote triage begins within about an hour of your first call. On site response in the Raleigh Durham Chapel Hill triangle is same day in most cases. For organizations elsewhere in North Carolina and the Southeast, we typically deploy within twenty four hours when physical access is required. Most ransomware, business email compromise, and account takeover work happens remotely and starts the moment we pick up the phone.
What does an emergency engagement cost?
We quote a fixed scope for the first seventy two hours based on the complexity and blast radius, then move to a time and materials basis for extended recovery. Cyber insurance usually covers professional incident response at the agreed panel rates. A short scoping call costs nothing. Call (919) 348-4912 and we will walk you through the numbers.
Should I pay a ransom?
The FBI and CISA strongly advise against paying. Many victims who pay are attacked again within a year by the same group or one of its affiliates. Payment also rarely returns all data intact, and in some cases sending funds to sanctioned groups can expose your organization to OFAC penalties. That said, there are rare cases where payment is the least bad option. That decision is made by you, your counsel, your insurance carrier, and an approved negotiator, with full eyes open on the legal and operational risks.
Do I have to tell customers and regulators?
If regulated data (protected health information, cardholder data, personal data under state law, controlled unclassified information) was accessed or exfiltrated, almost certainly yes. The specific triggers, timelines, and wording come from your counsel based on HIPAA, state data breach laws, PCI DSS, and federal contracting rules. Our job is to give counsel the evidence trail required to make that decision correctly.
Can Petronella handle my cyber insurance paperwork?
We coordinate directly with your carrier and their panel counsel throughout the engagement. We supply the status memos, forensic findings, and final incident report the carrier needs to approve costs and adjust the claim. We do not file the claim itself, but we work alongside your broker or in house risk team.
What if the incident turns out to be a false alarm?
Good. That happens regularly and it is a much better outcome than a missed real incident. You pay for the scoping call and any triage work already performed. No one is going to scold you for calling early.
Can you help individuals, not just businesses?
Yes. Crypto theft, SIM swap, romance scams, sextortion, and hacked personal accounts are some of the most common intake patterns. Individual engagements are scoped differently, but we do not turn victims away.
Agencies And Hotlines You Should Know
These federal and state resources are a core part of most emergency response plans. Most are free.
FBI IC3, ic3.gov. Online intake for cyber crime reports, including business email compromise, ransomware, crypto theft, and tech support scams. The Recovery Asset Team has a strong track record on wire fraud when the report is filed within seventy two hours.
CISA, cisa.gov/report. Critical infrastructure and significant cyber incident reporting. A place to exchange indicators of compromise.
NC State Bureau of Investigation Computer Crimes Unit. North Carolina specific investigative resource for computer intrusions and online fraud.
HHS Office for Civil Rights, hhs.gov HIPAA breach notification portal. HIPAA breach notification portal. Five hundred plus individual breaches must be reported within sixty days.
DoD DIBNet, dibnet.dod.mil. Defense Industrial Base cyber incident reporting. Seventy two hour window when controlled unclassified information is impacted.
NCMEC CyberTipline, report.cybertip.org. National Center for Missing and Exploited Children. Required reporting route for any incident involving exploitation of minors.
FTC, reportfraud.ftc.gov. Consumer fraud intake. Useful for identity theft and tech support scam cases.
Related Recovery And Response Guides
The Sooner You Call, The More We Can Save
Every hour an attacker sits inside your environment is another hour of data exfiltration, lateral movement, and credential theft. If you think you are in trouble, you probably are. Call Petronella Technology Group at (919) 348-4912 and get a real person on the phone.