Ransomware recovery system

A system comprising:

• at least one processor;
• and
• at least one memory, the at least one processor and the at least one memory configured to cause the system to:
• retrieve a first backup of a virtual machine from a storage environment, the first backup of the virtual machine comprising data of the virtual machine and network connectivity information of the virtual machine in a first software defined data center (SDDC) running on a first set of host machines;
• configure a second SDDC running on a second set of host machines based on the network connectivity information, wherein the second SDDC is network isolated from the first SDDC;
• power on the virtual machine from the first backup in the second SDDC;
• send, from the virtual machine to a security platform, behavior information of the virtual machine running in the second SDDC;
• and
• determine, based on the behavior information, whether the virtual machine running in the second SDDC is infected with malware.

A non-transitory computer-readable medium comprising instructions that, when executed by at least one processor of a computing system, cause the computing system to perform operations for virtual computing instance remediation, the operations comprising:

• retrieve a first backup of a virtual machine from storage, the first backup of the virtual machine comprising configuration information of the virtual machine and data of the virtual machine, the configuration information comprising network connectivity information of the virtual machine in a first software defined data center (SDDC) running on a first set of host machines;
• configure a second SDDC running on a second set of host machines based on the configuration information, wherein the second SDDC is network isolated from the first SDDC;
• power on the virtual machine from the first backup in the second SDDC;
• send, from the virtual machine to a security platform, behavior information of the virtual machine running in the second SDDC;
• determine, based on the behavior information, whether the virtual machine running in the second SDDC is infected with malware;
• and
• in response to determining that the virtual machine running in the second SDDC is infected with malware, remediate the malware.