Ransomware has been deployed across part of your estate. A known family was used, a ransom note was left, but no data exfiltration has been observed despite C2 being active for six days beforehand. What are your hypotheses, and how would you test them?

The interesting fact is the one that is missing. Six days of active C2 followed by encryption, with no exfiltration observed, is inconsistent with how double-extortion operations typically behave, and that inconsistency is what should drive the analysis.

Before generating hypotheses I would flag that "a known family was used" tells me very little. Under the affiliate model the family identifies the service, not the operator, and the same encryptor is used by many unrelated affiliates with different tradecraft. It is consistent with every hypothesis below, so it has no diagnostic value and I would set it aside rather than treat it as a lead.

Hypotheses:

One, this is a normal ransomware operation and exfiltration did occur but we did not see it. Two, an affiliate chose not to exfiltrate — some do not, particularly where the data has little resale or extortion value. Three, this is destructive activity presented as ransomware, where the encryption is cover and there was never an intention to decrypt. Four, the intrusion was interrupted — they were still staging when something forced their hand. Five, an insider, where the six days look different because the access was legitimate.

The first test is about my own visibility, and it comes before everything else: could we have seen exfiltration at all? What egress monitoring do we have, what is the retention, and are there gaps — an unmonitored path, a cloud storage service on the allow-list, an encrypted channel we do not inspect. If the answer is that we could not have seen it, hypothesis one moves straight to the front and the others lose most of their support.

Assuming we do have visibility, concrete tests. Proxy and DNS volume analysis over the six days, looking for sustained outbound transfer or a large number of uploads to cloud storage or file-sharing services. Host evidence of staging — archive files, unusual compression tool execution, large temporary files in staging directories. Whether volume shadow copies and backups were deliberately destroyed, which is common to both hypotheses one and three but tells me about intent. And critically, whether the encryptor has a functioning decryption path and whether the C2 infrastructure supports key retrieval — if the encryption is not actually reversible, hypothesis three jumps sharply.

For hypothesis four I would look at the timeline for signs of a truncated operation: incomplete lateral movement, encryption starting before the actor had reached the highest-value systems, or a detection or containment action on our side that preceded it.

For hypothesis five, authentication patterns before the compromise window and whether the initial credentials were valid beforehand.

I would rank by inconsistency rather than by supporting evidence, and I would be explicit about what would falsify my lead. If my lead is that exfiltration occurred undetected, then confirming comprehensive egress coverage with no matching volume would be the thing that breaks it.

I would not name a group. The family gets used by many affiliates and there is nothing here that supports an operator-level identification.

Finally, the business consequence, because this is not an academic exercise: whether data was exfiltrated drives regulatory notification obligations, breach disclosure, and the negotiation posture. I would tell the incident commander that the exfiltration question is currently unresolved, what my current judgement and confidence are, what I am doing to resolve it, and by when — rather than letting an unstated assumption drive a legal decision.