Below is a based on that scenario. Incident Report: “Ransom – No Rest for the Wicked” (Zip-Based Ransomware Campaign) Report ID: IR-2025-04-17-001 Date of Report: April 17, 2026 Prepared by: Security Incident Response Team (SIRT) 1. Executive Summary On April 16, 2026, multiple endpoints within the corporate environment exhibited unusual file behavior. User files (documents, images, databases) were replaced with .zip archives bearing the naming pattern: [original_filename].zip accompanied by a ransom note file RANSOM_NO_REST.html .
48 hours, or upon discovery of decryption method.
