What should you do if your files turn up encrypted with a ransom note attached? The first thing is to isolate the machine from the network to stop the spread, without treating payment as the first option. Getting the sequence right in the first few hours can save you time, money and data that is genuinely recoverable.
Step 1: isolate, but do not switch off straight away
Disconnect the network cable or turn off the Wi-Fi on the affected machine immediately, so the ransomware cannot carry on encrypting other machines or servers on the same network. Shutting the machine down completely is not always the right first move: it can interrupt an encryption that is halfway through, leaving files partially recoverable, and it wipes information held in memory that can help identify how the attack got in. Isolate from the network, yes. Power off immediately, not necessarily.
Step 2: work out how far it reached
Check which other machines or servers share the same network, and whether any connected backups may also have been reached. Many ransomware attacks specifically hunt for backup volumes before encrypting anything else, precisely to remove the possibility of restoring without paying.
Step 3: do not pay the ransom yet
Before considering payment, check whether a public decryptor exists for that specific variant, and assess whether there are backups that were not compromised. Paying does not guarantee you get the files back, and it directly funds future attacks. It is the last option, not the first.
Step 4: preserve the evidence
Do not delete the ransom note or the encrypted files. They are what identifies the variant of the attack and, if the case calls for it, what supports a report to your insurer or to the authorities.
Step 5: bring in specialists in post-ransomware recovery
From here, a specialist can analyse the variant, check whether there are copies or snapshots that were not compromised, and assess realistically what can be recovered without paying the ransom.
Services related to this article
