Decision card: isolate first, restore only after clean assessment
The wrong first move is to keep clicking around on an infected machine. Disconnect affected devices from the network, preserve evidence and restore from known-good backups only after the environment is clean.
- Disconnect Wi-Fi, Ethernet and external drives from affected devices.
- Do not pay or contact attackers from the infected machine.
- Preserve ransom notes, filenames and timestamps for responders or insurers.
- Rotate passwords from a clean device after containment.
Recommended next reads
- Best antivirus 2026 — compare endpoint protection
- Password manager comparison — rotate and store credentials safely
- Qilin ransomware guide — current ransomware context
- Data breach response checklist — post-incident identity cleanup
Immediate containment steps
Ransomware response is about stopping spread before recovery. Every extra minute connected to shared drives, cloud sync or office networks can expand the blast radius.
- Disconnect the device from internet and local networks.
- Unplug external drives and pause cloud sync if safe to do so from another device.
- Take photos of ransom notes and error messages.
- List affected users, machines, shared folders and cloud accounts.
- Call professional incident-response help for business, legal, healthcare or customer-data systems.
Recovery sequence
Do not restore backups into an infected environment. Rebuild clean systems first, then restore data that was backed up before the infection.
| Assess | Identify entry point, affected systems and whether data was stolen as well as encrypted. |
|---|---|
| Rebuild | Wipe or reimage compromised machines when practical; do not trust local cleanup alone for severe infections. |
| Restore | Use offline or immutable backups from before the incident. |
| Rotate | Change passwords, API keys, VPN credentials and admin accounts from a clean device. |
| Harden | Patch exposed systems, remove unused remote access and deploy endpoint protection. |
Prevention after recovery
Ransomware prevention is layered. Antivirus helps, but password reuse, exposed remote desktop, missing patches and weak backups are common failure points.
- Use MFA on email, admin, VPN, cloud and finance accounts.
- Keep at least one offline or immutable backup.
- Patch browsers, VPN clients, remote-access tools and server software quickly.
- Use a password manager to eliminate reused credentials.
Ransomware response FAQ
Should I pay a ransomware demand?
Do not rush to pay. Payment can be illegal or ineffective, and it does not guarantee clean recovery. Get professional advice for business systems.
Can antivirus remove ransomware?
Antivirus may detect or remove some malware, but encrypted files and compromised credentials still require recovery and hardening.
Should I reset passwords after ransomware?
Yes, but do it from a clean device after containment. Prioritize email, banking, admin, VPN and cloud accounts.
Editorial note: This guide is educational and not legal, tax or financial advice. For active fraud, file official reports, freeze credit where appropriate and contact your bank or card issuer directly.