What to do: Disconnect the Ethernet cable or turn off Wi-Fi on the infected device. If the device is part of a corporate network, ensure the IT administrator isolates the infected network segment.
Why it matters: Ransomware can spread across the network to other computers, servers, or connected storage devices.
Why not pay: Payment does not guarantee you will receive the decryption key. Supporting attackers is unethical and encourages further attacks.
What to do instead: Focus on options to recover data from your own backups or existing decryption tools.
How to identify: Look at the ransomware name in the ransom note (the instruction file created by attackers). Compare the extension of encrypted files with databases, e.g., on ID Ransomware.
Next steps: If the ransomware already has a known solution, use available decryption tools from the No More Ransom website.
What to check: Are backups current and uninfected? Are they stored offline (e.g., on an external drive or tape unit)?
Recovery: If backups are safe, wipe the infected system completely and restore data from backups.
How to proceed: Boot the system in Safe Mode to minimize malware activity. Use tools like Malwarebytes, Emsisoft Emergency Kit, or Kaspersky Virus Removal Tool.
Procedure: After cleaning the device, restore the system from a clean backup or reinstall it.
If you don't have backups: Forensic tools exist that can partially recover data, e.g., Recuva, Disk Drill, or R-Studio. Results are not guaranteed, but it's worth trying.
Clean install: If encryption is irreversible and you don't have backups, reinstall the system. Check and safely save license keys and installation files beforehand.
Contact points:
What to prepare: A description of the incident (when and how the attack occurred). A sample of the encrypted file and ransom note (without activating malicious content).
Backups: Use regular offline backups. The 3-2-1 method is recommended:
Training: Teach employees to recognize phishing and untrustworthy attachments. Avoid suspicious emails with links or attachments.
System protection: Update your operating system and applications. Use firewalls and antivirus systems with threat detection features.
Need help with IT security or infrastructure?
Schedule a free consultation