My Ransomware Post-Mortem

A practitioner recounts an Osiris ransomware infection caused by a phishing email with a macro-enabled Excel attachment that encrypted files on one workstation but did not spread across the SOHO network. The impact was limited due to reliable backups and segmented network shares; the report highlights root causes (user enabled macros, insufficient user training), lessons learned, and remediation advice (test backups, restrict macros/execute-from-%Temp%, enforce least-privilege file shares, user education).