Readme.txt Ransom Note

What the note is doing in a ransomware intrusion

A readme.txt ransom note is not the attack itself, but the attacker’s post-compromise message. It confirms that encryption has already disrupted access, frames the event as extortion, and often reveals how the attacker wants the victim to respond. In many cases, the note is part of the broader ransom workflow rather than a standalone file artifact.

That makes it useful for incident triage. A note can help responders confirm ransomware over ordinary file corruption, distinguish a staged extortion event from a mistaken deletion, and start correlating user reports with the first signs of encryption or data theft. The note should be treated as evidence, not merely a nuisance file.

Why attackers use a README-style note

Ransomware operators want the victim to understand that the compromise is deliberate and monetized. A plain-text note is fast to deploy, hard to miss, and often placed in multiple directories so it survives partial cleanup. Its purpose is psychological as much as operational: it tells the victim that the attacker still controls the situation and expects payment, negotiation, or follow-up contact.

The file name itself is also practical. A generic name such as readme.txt blends into normal workstation clutter and can be dropped automatically alongside encrypted files. On large incidents, that simplicity helps the attacker scale the message across many endpoints, shared folders, and servers without needing a custom interface.

What the note can reveal about the intrusion

The wording, file paths, contact addresses, and demands in a ransom note can provide clues about the intrusion method and the attacker’s operating model. Even when the prose is generic, the note may point to double extortion, pressure tactics, or a specific negotiation channel. If the note appears on systems where users should not be able to write files, that can also indicate broader compromise of administrative or remote access paths.

For responders, the note helps establish timing. If it appears alongside mass file renames, backup deletion, or sudden access failures, it strengthens the conclusion that the environment was hit by ransomware rather than a single-host issue. MITRE ATT&CK T1486 Data Encrypted for Impact is the broader pattern this note usually accompanies, while Rhysida ransomware profile guide shows how notes and encryption activity sit inside a larger intrusion and detection picture.

How defenders should handle a ransom note

A ransom note should be preserved as evidence, but it should not be opened, edited, or used as a primary source of truth for recovery decisions. Security teams normally copy it into the incident record, collect surrounding host and file-system telemetry, and compare it with backup status, encryption spread, and any signs of data exfiltration. The note is one artifact in a larger compromise review.

Because the file is typically planted after encryption, the immediate response should focus on containment and restoration rather than negotiation. CISA cyber threat advisories are the place to check for current ransomware guidance, and note content should be assessed alongside endpoint, identity, and backup evidence so responders can decide whether the incident is limited to encryption or includes theft, persistence, or later re-entry.

Risk and Threat Considerations

The note is a visible symptom of a wider ransomware event, so the real risk is not the text file itself but the compromise it confirms. It usually means the attacker has already achieved encryption, may have accessed backups or adjacent systems, and may be using the note to pressure the victim before recovery steps are complete.

Failure mechanism: The attacker leaves a broad, easy-to-find message after encrypting data, which both confirms impact and supports extortion while the environment remains degraded.

Impact: Organisations can lose operational continuity, evidence can be overwritten if response is delayed, and the note may become the trigger for rushed decisions without a full assessment of data theft, persistence, or recovery options.

Practitioner Guidance

What to watch for: Treat the note as a triage indicator, not a recovery plan. Its value is in helping you confirm scope, preserve evidence, and line up file-encryption activity with host, backup, and identity telemetry. If the note appears on multiple systems or in shared locations, assume the incident is broader than a single endpoint until proven otherwise.

Practitioner takeaway: The note matters because it marks the point where technical compromise becomes an operational and extortion event, so response quality depends on disciplined evidence handling, not on the message itself.

Related resources from NHI Mgmt Group

• What happens when ransomware encrypts files without changing extensions but still drops a ransom note?
• Ransom Note Artifact
• Ransom Note Detection
• What do security teams get wrong about robots.txt and allowlists?