XcellSecure|Ransomware Protection
Ransomware needs a way in, room to spread, reachable backups and time. We take all four away.
Encryption attacks demanding payment — stopped. Patching, MFA and EDR at the front; immutable backups in India and a 24×7 SOC in Mumbai behind them.
Encryption is the last step, not the first. Most attacks run for days before it.
A ransomware attack is a sequence. Each step leaves traces and each step can be blocked. Here it is in plain language, mapped to MITRE ATT&CK tactics and techniques — tap a step.
Technique IDs from MITRE ATT&CK (attack.mitre.org), checked November 2026. We describe what defenders see, not how attacks are carried out.
Common, costly, and usually avoidable. What the official numbers say.
Figures from CERT-In and PIB first, then the large global studies. Each is dated; none is ours.
How attackers got in, per CERT-In's 2024 ransomware report
The report names exposed services, not exotic exploits. Every item below is a configuration you can check this week.
- Remote Desktop (RDP) open to the internet, brute-forced or hit with stolen passwords
- Microsoft SQL servers exposed and brute-forced
- Internet-reachable VMware ESXi and vCenter consoles with weak access rules
- Public cloud storage misconfigurations, weak IAM policies and compromised credentials
- Exposed NAS devices, Redis servers and firewall management consoles
- Unpatched vulnerabilities and backdoors left by incomplete clean-up
The signals arrive early. Someone has to be watching.
What our SOC alerts on, grouped by how long they usually come before encryption. Any one of these deserves a call.
- New admin accounts nobody requested
- VPN or cloud sign-ins from unusual countries or impossible travel
- Remote-access tools IT didn't install
- Security alerts quietly switched off or excluded
- Network scanning from a user laptop
- Credential-dumping alerts on servers
- Large uploads to cloud storage at odd hours
- Backup jobs failing, shortened or deleted
- Volume shadow copies deleted
- Antivirus, EDR or backup services stopped
- Mass file renames with a new extension
- Ransom-note files appearing in many folders
Prevent → Detect → Respond → Recover.
No single product stops ransomware. Four layers, each assuming the one before it failed.
Prevent
Shrink the ways in.
- Patching for VPNs, firewalls, servers and apps
- MFA on remote access, email and admins
- Privileged access with just-in-time admin
- Email security and awareness training
- Microsegmentation around servers and backups
Detect
See the steps before encryption.
Respond
Contain in minutes, not hours.
- 24×7 SOC that can isolate hosts
- Case management with CERT-In timers
- Forensics & incident response
- MXDR for Microsoft
Recover
Restore clean, in the right order.
- Immutable Acronis* backups with warranty
- Veeam* or Commvault* operations
- Entra ID backup for identities
- Cloud DR with tested runbooks
How ready are you for a ransomware attack?
Ten questions, weighted by how often each gap shows up in real incidents. Answers stay in your browser.
The first 60 minutes. Practise them before you need them.
Step through what to do, tick it off and run a drill clock. Download the checklist for your incident binder.
—
0 of 0 actions ticked
Ninety days from exposed to tested.
The order we usually work in. Each block ends with something you can show an auditor, an insurer or your board.
- Inventory internet-facing services; close exposed RDP, SMB and SQL
- Patch VPN, firewall and edge devices first
- MFA on every remote, email and admin login
- EDR with tamper protection on all servers and laptops
- One immutable backup copy in India; Entra ID backed up
- Separate admin accounts; just-in-time privileged access
- Segment backup consoles and management networks
- Email filtering and DMARC enforcement
- Logs into a SIEM, kept 180 days in India
- First restore drill with RTO measured
- Tabletop exercise with leadership and legal
- Attack simulation against your controls
- Incident plan with CERT-In, DPDP and regulator roles
- Quarterly restore drills scheduled
- Board report: score before and after
Every control above is a service we already run.
Pick individual services or let us run the lot. Items marked * are partner products we resell and operate.
When ransomware hits, several clocks start at once.
General information, not legal advice. Your regulator's latest text prevails.
DPDP Act, 2023 & Rules, 2025
If personal data is affected: intimation to the Data Protection Board and each affected person without delay, and a detailed report to the Board within 72 hours. Core duties apply from 13 May 2027. DPDP platform →
RBI & SEBI
Regulated entities also report under their regulator's directions — urban co-operative banks, for example, on RBI's DAKSH platform within six hours. SEBI's CSCRF (20 August 2024) expects SOC monitoring and tested recovery.
Report the crime
Ransomware is extortion. File with the police or the National Cyber Crime Reporting Portal (cybercrime.gov.in); call 1930 if money has moved.
On paying
We don't negotiate with attackers. CERT-In's report advises verifying extortion claims with evidence before any payment; decide with your counsel and insurer. Paying does not guarantee a working decryptor.
Assess, protect, or hand it over. Priced from our published services.
Per-user bundles are the sum of component prices on the linked XcellHost pages. Indicative, excl. 18% GST.
Ransomware Readiness Assessment
- External exposure review: RDP, VPN, SQL, ESXi
- MFA and admin-account audit
- One witnessed restore test
- Scored report and 30-60-90 plan
Prevent + recover, you monitor
- Acronis Advanced* — backup + EDR₹558
- Patching — OS + apps₹199
- Managed MFA₹99
- Entra ID backup₹125
Everything, watched 24×7
- Protect bundle₹981
- Security Operations Professional₹449
- CERT-In reporting retainer₹14,999/mo
Component prices as published on Acronis Anti-Ransomware Warranty, Patch Management, MFA, Entra ID Backup, Security Operations and Managed Sentinel — indicative, excl. 18% GST. The assessment price is a new placeholder. Acronis warranty terms are set by Acronis.
Build your ransomware bundle. See the first invoice.
First invoice = one-time items plus the first month (and the first quarter for drills).
XcellSecure Ransomware
Prices as on the linked XcellHost pages; the assessment is an indicative placeholder. All excl. 18% GST in the lines above.
Ransomware, answered.
Malicious software, run by a criminal group, that encrypts your files and systems so they can't be used, then demands payment for a decryption key. Most groups now also copy data out first and threaten to publish it, so a restore alone doesn't end the extortion. The encryption is the final step of an intrusion that usually began days or weeks earlier.
No. Attackers often log in with stolen passwords and use normal admin tools, which signature antivirus won't flag. EDR watches behaviour (credential dumping, shadow-copy deletion, mass renames) and can isolate a machine; MFA, patching and segmentation stop the entry and spread; immutable backups make recovery possible if everything else fails.
The storage refuses changes or deletion until a retention period ends — even from an administrator account. That matters because attackers look for backup consoles and delete recovery points first (ATT&CK T1490). We keep the immutable copy in India and test restores from it every quarter.
Isolate affected machines from the network but leave them powered on, protect your backups, call +91 22 6711 1555, and start a timeline. Don't wipe machines or delete encrypted files — they are evidence. The first-60-minutes playbook above lists every step.
Under CERT-In's directions of 28 April 2022, specified incidents — ransomware is one — must be reported to CERT-In within 6 hours of noticing them. If personal data is affected, the DPDP Rules require intimation to the Data Protection Board and affected persons, with a detailed report within 72 hours (core duties from 13 May 2027). Banks, market entities and insurers also report to their regulator. We prepare the evidence pack; your organisation files.
That decision belongs to your leadership, counsel and insurer. Facts that help: the Verizon 2026 DBIR found 69% of ransomware victims did not pay; payment doesn't guarantee a working decryptor or that stolen data is deleted; CERT-In advises verifying extortion claims with evidence. Tested, immutable backups are what make "no" a realistic answer.
They add up prices already published on our pages: Acronis Advanced ₹558, endpoint patching ₹199, Managed MFA ₹99 and Entra ID Backup ₹125 per user per month for Protect (₹981), plus Security Operations Professional at ₹449 for Managed (₹1,430). All indicative, excl. 18% GST. The ₹49,999 assessment is a placeholder until confirmed.
Yes. XcellHost is a Microsoft Gold Partner. If you hold Business Premium or E5, Defender for Endpoint, Entra ID and Intune already cover much of Prevent and Detect; we configure them, swap Acronis EDR out of the bundle and add backup, SOC monitoring and drills. See Microsoft Defender.
At least quarterly, and after any major change. A drill restores a sample of critical systems into an isolated network, measures the time taken against your recovery target and records the result. That record is the "0" in 3-2-1-1-0 and the evidence insurers and auditors ask for.