Isolate affected systems
Because the most common ransomware variants scan networks for vulnerabilities to propagate laterally, it’s critical that affected systems are isolated as quickly as possible. Disconnect ethernet and disable WiFi, Bluetooth and any other network capabilities for any infected or potentially infected device.
Two other steps to consider:
- Turning off maintenance tasks. Immediately disable automatic tasks—e.g., deleting temporary files or rotating logs—affected systems. These tasks might interfere with files and hamper ransomware investigation and recovery.
- Disconnecting backups. Because many new types of ransomware target backups to make recovery harder, keep data backups offline. Limit access to backup systems until you’ve removed the infection.
Photograph the ransom note
Before moving forward with anything else, take a photo of the ransom note—ideally by photographing the screen of the affected device with a separate device like a smartphone or camera. The photo will expedite the recovery process and help when filing a police report or a possible claim with your insurance company.
Notify the security team
Once you’ve disconnected the affected systems, notify your IT security team of the attack. In most cases, IT security professionals can advise on the next steps and activate your organization’s incident response plan, meaning your organization’s processes and technologies for detecting and responding to cyberattacks.
Don’t restart affected devices
When dealing with ransomware, avoid restarting infected devices. Hackers know this might be your first instinct, and some types of ransomware notice restart attempts and cause additional harm, like damaging Windows or deleting encrypted files. Rebooting can also make it harder to investigate ransomware attacks—valuable clues are stored in the computer’s memory, which gets wiped during a restart.
Instead, put the affected systems into hibernation. This will save all data in memory to a reference file on the device’s hard drive, preserving it for future analysis.
