What to do in the event of a ransomware attack: step-by-step response plan

If you are looking for what to do during a ransomware attack, you need to act quickly but without panic. The main goal in the first minutes is to stop the spread of the malware, preserve evidence, protect backups, and prepare for a safe recovery. This article explains a practical course of action for companies and home users: how to identify ransomware, what to disconnect, who to notify, whether to pay the ransom, and how to reduce the risk of a repeat attack.

Ransomware blocks access to files and systems and then demands a ransom for a decryption key. Sometimes attackers also steal data and threaten to publish it. Therefore, the response should consider not only the recovery of files but also the potential information leak.

Short plan for the first 15 minutes

Below is a condensed algorithm that helps buy time and reduce damage. It is suitable for most cases when encrypted files, a ransom note, or mass data access errors appear on the computer.

1. Isolate the infected device from the network. Disconnect the Ethernet cable, Wi-Fi, and VPN. Do not connect external drives.
2. Do not delete the ransom note or suspicious files. They may be needed for investigation and finding a decryption tool.
3. Do not restart the computer without a specialist's instruction. Sometimes after a reboot, traces of the attack are lost or encryption continues.
4. Notify the IT or information security officer. If you are at home, record the time of the incident and take a screenshot of the screen.
5. Disable shared folders and network storage, if accessible. It is important to stop the spread through SMB, RDP, VPN, and other channels.
6. Check backups, but do not connect them to the infected environment. Backups need to be protected from overwriting and infection.
7. Gather minimal information. Device name, user, time of detection, extensions of encrypted files, ransom note text.
8. Do not pay immediately. First, assess the scale, availability of backups, legal risks, and the possibility of free decryption.

How to understand that it is a ransomware attack

Not every file corruption means ransomware. However, there are signs that collectively almost always indicate a ransomware attack.

Main signs of infection

Typical symptoms include:

• files have received a new unusual extension;
• documents, databases, photos, or archives can no longer be opened;
• files with ransom payment instructions have appeared in the folders;
• the desktop has changed to a threatening message;
• antivirus, EDR, or SIEM has recorded mass file changes;
• servers have begun to operate slowly, and disks are actively writing data;
• users have lost access to network folders;
• accounts are suddenly blocked or being used from unusual addresses;
• logs show connections via RDP, PowerShell, PsExec, or suspicious scripts.

The situation is particularly dangerous when encryption occurs simultaneously on multiple computers or a file server. This means that attackers may have already gained administrative rights.

What not to consider as evidence on its own

A single damaged file, disk error, or software failure is not always linked to ransomware. Therefore, it is important not to jump to conclusions. First, check the logs, antivirus events, login history, and status of other devices. But if there is a ransom note and mass renaming of files, respond as if it were a real incident.

Step-by-step incident response

During a ransomware attack, it is important to act sequentially. Chaotic actions hinder investigation and can increase damage. Below is a practical order that can be used as a checklist.

Step 1. Appoint a coordinator

There should be one responsible coordinator in the company: IT director, information security specialist, shift supervisor, or external expert. They record decisions, distribute tasks, and prevent conflicting actions.

For a home user, the coordinator's role is simpler: record the discovery time, what was happening before the incident, what devices were connected, and what files were affected.

Step 2. Isolate infected systems

Isolation is the main priority. Disconnect the network on infected devices, but do not begin to turn everything off indiscriminately without a plan. If encryption is actively happening on a file server, immediate disconnection of the network interface or blocking access to shared resources may be necessary.

Actions to take:

• disconnect network cables from infected workstations;
• turn off Wi-Fi and VPN clients;
• block suspicious accounts;
• temporarily restrict RDP, SMB, and administrative connections;
• disable synchronization of cloud folders if it spreads encrypted files;
• separate critical servers from the user network.

What to avoid: do not connect flash drives, external disks, and backup media to the infected computer. This can encrypt the only copy of the data.

Step 3. Preserve evidence

Evidence helps understand the ingress path and determine a restoration method. Do not delete the ransom note, suspicious executable files, archives, scripts, and logs. If possible, create a disk image or a snapshot of the virtual machine.

It is helpful to preserve:

• screenshots of the ransom messages;
• a sample of an encrypted file and its original, if available;
• the text of the ransom demand;
• logs from Windows, Linux, VPN, firewall, mail gateway, and EDR;
• a list of active processes and network connections;
• information about the time of first activity.

Do not send confidential files to random sites for verification. Use only trusted services and pre-remove personal or commercial data if possible.

Step 4. Stop attacker accounts

Many modern ransomware attacks start not with a virus file, but with a stolen password. Attackers gain access through VPN, RDP, cloud panel, email, or an administrator account. Therefore, it is necessary to quickly check suspicious logins.

Actions:

• disable accounts identified in suspicious logins;
• change administrator passwords from a clean device;
• revoke active VPN sessions and tokens;
• check forwarding rules in emails;
• enable MFA where it was not present;
• check new accounts and changes in administrator groups.

It is important to change passwords only after isolating infected systems. If malware is running on the computer, it may intercept the new credentials.

Step 5. Determine the scale of the attack

Before recovery, it is necessary to understand what exactly is infected. Otherwise, you risk bringing back a system that the attacker still has access to.

Check:

• user workstations;
• file servers and network folders;
• domain controllers;
• backup servers;
• hypervisors and virtual machine storage;
• cloud directories and SaaS services;
• mailboxes and forwarding rules;
• logs from VPN, firewall, and proxies.

Create a list of systems in three categories: infected, suspicious, conditionally clean. Then update it as the investigation proceeds.

Step 6. Protect backups

Backups are the main resource when recovering from ransomware. But many attacks specifically target backup servers. Therefore, do not start recovery until you are sure that the copies are not damaged and not accessible to the attackers.

Check whether there are:

• offline copies on disconnected media;
• immutable backups, such as immutable storage;
• copies made before the compromise date;
• separate accounts for the backup system;
• logs of deletions, overwrites, or failed backup jobs.

If the backups are stored in the cloud, check the version history, recycle bin, access settings, and login logs.

Step 7. Choose a recovery strategy

There are three main options: restoring from backups, decrypting with an available tool, or full reinstallation with clean data transfer. Often, a combination is used.

Situation	Best action	What to avoid
There are clean backups	Reinstall systems and restore data from backups	Restoring over an infected OS
There is a known decryption tool	Test it on copies of files	Running untested utilities from unknown authors
No backups	Save disk images and consult experts	Deleting encrypted files and formatting disks right away
There are signs of data leakage	Engage lawyers and management	Hiding the incident from responsible parties
The domain infrastructure is infected	Restore a trusted environment from scratch or from clean copies	Simply changing passwords and switching servers back on

Should we pay the ransom?

The short answer is: do not pay until safe options have been exhausted. Payment does not guarantee decryption, does not ensure the deletion of stolen data, and may create additional legal and reputational risks. Moreover, you show the criminals that the organization is willing to pay.

However, in real life, a decision is sometimes considered when it comes to critical infrastructure, threats to human life, or a complete lack of recoverable backups. In such cases, the decision should be made by management along with lawyers, security specialists, and, if necessary, law enforcement. It is important to consider sanction restrictions and the risk of funding criminal groups.

Before any decision, check:

• are there working backups;
• is the type of ransomware known;
• is there a free decryption tool available;
• have any data been stolen;
• what laws and contractual obligations are applicable;
• how the payment will affect future security.

If the attackers have sent what is called proof of decryption of one file, this still does not guarantee the recovery of the entire infrastructure.

Where to find a decryption tool

Sometimes files can be restored without paying a ransom. Free decryptors are published for certain families of ransomware. You can start with well-known anti-ransomware projects like No More Ransom, antivirus manufacturers' websites, and national cybersecurity center recommendations.

Before using a decryptor:

1. Make copies of encrypted files.
2. Keep the original files unchanged.
3. Run the tool on an isolated machine.
4. Check the source of the download.
5. Test the decryption on a small set of data.

Do not trust websites that promise universal decryption of all ransomware. There is no universal decryptor.

Recovery after a ransomware attack

Recovery is not just about returning files. You need to ensure that the attacker no longer has access and that the vulnerability through which the attack occurred is closed.

Restore only in a clean environment

The best approach is to deploy new systems or restore them from known clean images. Then install updates, configure protection, change passwords, and only afterward transfer data from verified backups.

Simply deleting the malware file and continuing operations is not advisable. Modern ransomware groups often leave multiple backdoors: new accounts, scheduled tasks, web shells, modified policies, access tokens, and hidden remote management tools.

Check the compromise date

Infection may have started days or weeks before encryption. If you restore too recent a copy, you may bring back a system that is already compromised. Therefore, look for early signs: the first suspicious login, script execution, new account creation, protection disabling, network scanning.

Test data before business resumption

Before bringing systems back into operation, check the integrity of databases, access rights, application functionality, and configuration accuracy. For critical services, conduct a test launch in an isolated segment.

A helpful order:

1. Restore infrastructure services: domain, DNS, DHCP, identification.
2. Restore security systems: EDR, SIEM, logs, backup.
3. Bring business-critical applications online.
4. Check data and access rights.
5. Connect users by groups, not all at once.
6. Monitor the network after launch.

What businesses should do in the event of a ransomware attack

For an organization, an incident involving ransomware impacts not only IT. It affects operations, clients, contracts, personal data, and finances. Therefore, it is crucial to immediately include management and legal representatives.

Organize communications

Appoint responsible individuals for internal messaging, communication with clients, partners, and contractors. Do not make unverified promises. It is better to communicate facts: which services are unavailable, what has already been done, when the next update will be.

Employees need to be informed:

• which systems should not be turned on;
• where to report strange files and emails;
• whether personal devices can be used;
• what communication channels are official;
• who makes decisions regarding recovery.

Assess the risk of data leakage

If the attackers had access to the network, theft of information cannot be ruled out. Check outbound traffic, archives, cloud uploads, proxy logs, emails, and actions of privileged accounts. If personal data, commercial secrets, or customer data may have been compromised, involve lawyers and determine notification responsibilities.

Different countries and industries have different requirements. Therefore, there is no universal notification template. But hiding an incident within the organization is dangerous: it hinders proper investigation and increases the risk of a repeat attack.

Seek professional help if you lack experience

If servers, the domain, backups, or multiple sites are infected, it is better to engage an incident response team. Specialists can help preserve evidence, identify the point of entry, assess leakage, and develop a secure recovery plan.

What to do for home users

If ransomware has attacked a personal computer, the procedure is simpler, but the principles remain the same.

Do the following:

1. Disconnect the computer from the internet and home network.
2. Do not connect an external drive with photos or archives.
3. Take a photo of the ransom message.
4. Copy a few encrypted files and the note onto a separate media if a specialist asks you to do so.
5. Check other devices in the house.
6. Change passwords for email, banking, cloud services, and social media from a clean device.
7. Check cloud storage and file version history.
8. Find out if there is a free decryption tool available for your type of ransomware.
9. Reinstall the system or contact a service if you are unsure of your computer's cleanliness.

If encrypted files were synchronized in the cloud, do not rush to clear folders. Many services allow the restoration of previous versions or rollback the state of the directory.

How to prevent a repeat attack

After recovery, you need to close the causes of the incident. Otherwise, the attack may recur through the same credentials or vulnerability.

Set up reliable backups

A good backup strategy is built on the principle of multiple independent copies. A practical guideline is to store data in at least different locations and have a copy that cannot be quickly modified from the working network.

Check:

• regularity of backups;
• automated test recovery;
• separate accounts for backups;
• protection from deletion and overwriting;
• offline or immutable copies;
• documentation for recovery of critical systems.

A backup that has never been tested cannot be considered reliable.

Strengthen access and accounts

Most damage arises from privileged rights. Limit administrative access, use MFA, disable unused accounts, and regularly check administrator groups.

Pay special attention to RDP and VPN. Do not leave RDP open on the internet. For remote access, use VPN, MFA, IP restrictions, and monitor logins.

Update and segment the network

Updates close known vulnerabilities, while segmentation prevents ransomware from quickly reaching all systems. Separate user computers, servers, backup, production systems, and administrative workplaces.

Also useful are:

• EDR or quality antivirus protection;
• centralized log collection;
• email and attachment filtering;
• blocking macros from the internet;
• control over script execution;
• principle of least privilege;
• training employees on phishing;
• incident response plan.

Frequently asked questions about ransomware attacks

Is it okay to turn off the computer during a ransomware attack?

If encryption is actively ongoing, isolation from the network is the top priority. Completely shutting down sometimes helps stop the process but may destroy data in RAM that is needed for the investigation. In a company, it is better to first disconnect the network and call a specialist. At home, if the process is clearly encrypting files and help is unavailable, turning off may be a reasonable measure to stop the damage.

Should I delete the virus immediately?

Do not rush. First, preserve evidence and examples of files. Then delete the malicious program or reinstall the system. If you delete everything at once, it will be harder to understand how the attack occurred and which data might have been affected.

Can files be recovered without a backup?

Sometimes yes, if there is a decryptor for a specific ransomware family or if the data is preserved in shadow copies, cloud versions, email attachments, or on other devices. But there are no guarantees. Therefore, backups remain the main means of protection.

Will antivirus help after infection?

Antivirus can stop some malicious processes and find remnants of malware. But it does not always decrypt files and does not replace investigation. After an attack, it is important to understand the point of entry, change compromised credentials, and restore systems from a clean source.

What to do if a 1C server or database is encrypted?

First, isolate the server and stop user access. Then preserve a copy of the encrypted database, logs, and backups. Restore the database only in a clean environment and check the integrity of the data. If the server was in a domain, also check accounts, network folders, and neighboring servers.

How to tell if data has been stolen?

Analyze outbound traffic logs, account actions, file archiving, connections to cloud services, and tools used by the attackers. The absence of clear evidence does not always mean there was no leakage. If the data is sensitive, it is better to conduct a full investigation.

Where to turn after an attack?

Companies should consult incident response specialists, lawyers, the insurance company if cyber insurance is available, and, if necessary, law enforcement. A home user can contact a trusted service center and look for a decryptor on trusted resources.

Final action plan

In the event of a ransomware attack, the main thing is not to pay in panic and not to restore systems blindly. First, isolate infected devices, preserve evidence, protect backups, and determine the scale of the incident. Then restore data only in a clean environment, change compromised access, and close the point of entry. Start with isolation right now, document signs of the attack, and involve specialists if servers, backups, or critical data were affected.