A ransomware attack is one of the most time-sensitive cybersecurity incidents an individual or organization can face. Once ransomware is discovered, the priority is containment—not immediately decrypting files, reinstalling Windows, or paying the ransom.

Modern ransomware incidents may involve much more than file encryption. Attackers can compromise administrator credentials, move laterally between computers, access servers and network shares, steal information before encryption, delete backups, and maintain remote access to the environment.

For this reason, the first few minutes after discovering ransomware can significantly affect the extent of the damage.

CISA's #StopRansomware guidance recommends determining which systems have been affected and immediately isolating them. If multiple systems or subnets appear compromised, CISA notes that network-level isolation may be necessary.

Microsoft similarly recommends isolating compromised devices while preserving systems for investigation and recovery.

1. Immediately Isolate the Infected Computer

The first priority should normally be:

Disconnect the infected computer from the network as quickly as possible.

This is important because ransomware or the attacker controlling the compromised machine may attempt to communicate with:

• Other Windows computers
• File servers
• Domain controllers
• NAS devices
• Shared folders
• Mapped network drives
• Backup servers
• Database servers
• Hypervisors
• Remote Desktop servers
• Other network segments
• Cloud synchronization services

Isolation limits the attacker's ability to continue lateral movement and can prevent additional systems from becoming compromised.

Microsoft Defender for Endpoint specifically provides device-isolation functionality because isolating a compromised endpoint can help prevent attacker control, lateral movement, data exfiltration, and ransomware propagation.

2. Should a Ransomware-Infected Computer Be Disconnected from the Network?

Yes—in most cases, immediately.

If ransomware is suspected or confirmed, disconnect the affected computer from network connectivity.

For a wired computer:

Unplug the Ethernet/network cable.

For Wi-Fi:

Disconnect or disable Wi-Fi.

If the machine has multiple network connections, disable all unnecessary connectivity.

For example:

Ethernet → Disconnect
Wi-Fi → Disconnect
VPN → Disconnect
Mobile hotspot → Disconnect
Other network adapters → Disable/Disconnect

Do not assume disconnecting Internet access alone is enough.

A ransomware-infected computer may still communicate with other machines through the local network, even when the Internet connection has been blocked.

3. Why Network Isolation Is So Important

Many ransomware incidents involve lateral movement.

Consider a business network containing:

Internet
   |
Firewall
   |
Network Switch
   |
   +---- PC-01
   +---- PC-02
   +---- PC-03
   +---- File Server
   +---- Domain Controller
   +---- Backup Server
   +---- NAS

Suppose PC-02 becomes compromised.

If PC-02 remains connected, an attacker may attempt to access:

PC-02
  |
  +----> PC-01
  +----> PC-03
  +----> File Server
  +----> Domain Controller
  +----> NAS
  +----> Backup Server

Isolation changes the situation to:

PC-02
   X
Network

It does not remove the ransomware, but it can significantly reduce its ability to communicate or spread.

4. Do Not Immediately Shut Down the Computer Unless Necessary

This point is frequently misunderstood.

Network isolation and power shutdown are different actions.

Whenever practical, isolate the compromised system from the network without immediately powering it off.

Microsoft's ransomware response guidance recommends isolating compromised systems while preserving them for analysis.

Why?

A running system may contain valuable volatile forensic information in memory, including:

• Active processes
• Network connections
• Logged-in sessions
• Malware processes
• Command-line activity
• Encryption processes
• Authentication information
• Malware configuration
• Potential cryptographic material
• Indicators of compromise

Turning off the machine destroys volatile memory.

CISA therefore treats powering down as a fallback when affected systems cannot otherwise be disconnected from the network, while warning that doing so can destroy volatile forensic evidence.

Preferred approach

Detect ransomware
       ↓
Disconnect network
       ↓
Keep system isolated
       ↓
Preserve evidence
       ↓
Investigate

If isolation is impossible

If ransomware is actively spreading and you cannot disconnect the affected system from the network by other means, shutting down may become necessary to prevent additional damage.

Containment takes priority over preserving perfect forensic evidence when the attack is actively destroying the environment.

5. If Several Computers Are Being Encrypted

One infected workstation is different from an organization-wide ransomware event.

If ransomware suddenly appears on multiple computers, assume the incident may already have moved beyond the original endpoint.

CISA recommends considering network-level isolation when multiple systems or subnets appear affected.

Potential emergency actions can include:

• Isolating affected VLANs
• Disconnecting compromised switches or network segments
• Blocking suspicious communication
• Disabling compromised accounts
• Stopping suspicious remote-access sessions
• Temporarily restricting SMB traffic
• Isolating critical servers
• Protecting domain controllers
• Disconnecting vulnerable backup infrastructure

These decisions should preferably be coordinated by the organization's incident-response or security team.

6. Protect the Backup System Immediately

Backups are extremely valuable during a ransomware incident—which also makes them attractive targets.

Modern attackers frequently try to destroy recovery mechanisms before or during ransomware deployment.

If online backups are potentially reachable from compromised systems, consider isolating the backup infrastructure until the attack is contained. Microsoft specifically recommends considering disconnecting online backup systems during an active ransomware incident.

Protect:

• Backup servers
• NAS backup repositories
• External backup drives
• Backup management consoles
• Hypervisor backups
• VM snapshots
• Cloud backup credentials
• Replication servers

NIST recommends maintaining isolated backups so ransomware cannot readily spread to them and regularly testing restoration procedures.

7. Disconnect External Storage Where Appropriate

If external drives are connected to the infected machine, they may also be targets.

Examples include:

USB hard drives
External SSDs
USB flash drives
Mapped backup drives
Portable backup devices

However, avoid randomly modifying the compromised computer.

If professional forensic investigation is expected, coordinate evidence-preservation procedures with the incident-response team.

8. Pause Cloud Synchronization

Ransomware damage can sometimes propagate through synchronization rather than direct malware infection.

For example, ransomware encrypts:

C:\Users\User\OneDrive\Company\

The synchronization client may interpret the encrypted files as legitimate modifications and upload those changes.

Potentially affected services include:

• Microsoft OneDrive
• SharePoint synchronized libraries
• Google Drive
• Dropbox
• Other file synchronization platforms

Therefore, synchronization should be assessed and, where appropriate, paused until the incident is understood.

Microsoft's ransomware recovery guidance includes re-enabling OneDrive synchronization only after devices have been cleaned and data recovery has taken place.

9. Do Not Start Deleting Encrypted Files

Encrypted files may look useless, but do not immediately delete them.

For example:

Accounts.xlsx.locked
Database.bak.encrypted
Invoices.pdf.xyz
CompanyData.zip.abc

Keep copies of affected data where practical.

A decryptor may become available later, or encrypted files may be useful for determining:

• Ransomware family
• Encryption method
• File-extension pattern
• Scope of damage
• Recovery possibilities

Deleting everything can unnecessarily reduce recovery options.

10. Preserve the Ransom Note

Do not immediately delete ransom notes.

Common examples might look like:

README.txt
RECOVER_FILES.txt
HOW_TO_DECRYPT.html
RESTORE_FILES.txt

Preserve the ransom note and record:

• File name
• Text
• Email addresses
• URLs
• Cryptocurrency wallet addresses
• Victim ID
• Onion/Tor addresses
• Ransom amount
• Deadline
• Contact information

This information may help identify the ransomware family and support forensic or law-enforcement investigation.

11. Record the Encrypted File Extension

Look at several affected files without modifying them.

For example:

Invoice.xlsx

may have become:

Invoice.xlsx.locked

or:

Invoice.xlsx.abcd123

Record the extension exactly.

Also record whether filenames themselves have changed.

These characteristics can help identify the ransomware family.

12. Document Everything

Start an incident log immediately.

Record:

Date and time ransomware was discovered
Affected computer name
Logged-in username
IP address
MAC address
Ransom note filename
Encrypted file extension
Applications running
Servers contacted
Network shares connected
Security alerts
Suspicious emails
Recent downloads
Remote-access activity
Administrative actions performed

Also document who performed each response action and when.

A good incident timeline can become extremely valuable during forensic analysis.

13. Determine the Scope of the Attack

After initial containment, determine what else may have been compromised.

Investigate:

• Workstations
• Servers
• Domain controllers
• File servers
• NAS systems
• Hypervisors
• Virtual machines
• Database servers
• Backup servers
• Microsoft 365 accounts
• VPN accounts
• Remote-access systems
• Administrator accounts
• Service accounts

Microsoft recommends determining which user accounts, devices, applications, network communications, and payloads are associated with the incident.

14. Check Network Shares

Ransomware may encrypt network resources accessible to the compromised account.

Check:

\\SERVER\Accounts
\\SERVER\Data
\\SERVER\Backup
\\NAS\Documents

Also examine mapped drives:

F:
G:
H:
Z:

Do not assume a server itself is infected simply because files stored on it are encrypted.

A compromised workstation with sufficient permissions may have encrypted files remotely through SMB.

That distinction matters during forensic analysis.

15. Protect Active Directory

In a domain environment, Active Directory should be treated as a critical asset.

Attackers may compromise:

• Domain Administrator accounts
• Local Administrator accounts
• Service accounts
• Backup administrator accounts
• Remote Desktop credentials
• VPN credentials

Microsoft recommends disabling accounts believed to be compromised and protecting known-good domain controllers during ransomware response.

Do not blindly reset every password without an incident-response strategy, however. Credential remediation needs to be coordinated so attackers cannot simply capture the new credentials from systems that remain compromised.

16. Stop Suspicious Remote Sessions

Investigate remote-access mechanisms such as:

• RDP
• VPN
• Remote management software
• PowerShell remoting
• PsExec
• WinRM
• Remote monitoring tools
• Third-party support utilities

Microsoft's ransomware guidance recommends stopping remote logon sessions and taking action against compromised privileged or user accounts during containment.

17. Check Security Logs

Important Windows evidence may exist in:

Event Viewer
Windows Security Logs
Microsoft Defender Logs
PowerShell Logs
RDP Logs
Firewall Logs
Sysmon Logs
EDR Logs
VPN Logs
Domain Controller Logs

Security teams should preserve relevant logs before retention policies or attacker actions cause them to disappear.

18. Do Not Immediately Reinstall Windows

Reinstalling Windows may eventually be the correct remediation strategy, but it should normally occur after investigation and evidence preservation.

Immediate formatting may destroy information needed to answer:

• How did ransomware enter?
• Which account was compromised?
• Did the attacker steal data?
• Which computers were accessed?
• Was Active Directory compromised?
• Did the attacker create persistence?
• Were backup credentials stolen?
• Are other machines still compromised?

If the root cause remains unknown, simply rebuilding one PC may not remove the attacker from the environment.

19. Do Not Immediately Restore Backups

A common mistake is:

Ransomware detected
      ↓
Format computer
      ↓
Restore backup
      ↓
Reconnect network

This can result in reinfection if the original entry point remains open.

Before restoration, determine whether:

• Malware has been removed
• Compromised credentials have been changed safely
• Remote access has been secured
• Vulnerabilities have been patched
• Backup data is clean
• Other systems remain compromised
• Persistence mechanisms have been removed

Recovery should occur into a known-clean environment.

20. Scan Backups Before Restoration

Backups should not automatically be assumed clean.

A compromised environment may have been under attacker control for days or weeks before encryption.

Backups may therefore contain:

• Malware
• Web shells
• Malicious scripts
• Backdoors
• Scheduled tasks
• Compromised applications

CISA guidance recommends scanning backup data where possible before restoration.

21. Identify the Initial Attack Vector

Understanding how ransomware entered the environment is essential.

Common entry points include:

Phishing

A user opens a malicious:

Attachment
ZIP archive
Office document
PDF lure
Link
Fake login page

Compromised Remote Desktop

Attackers may obtain RDP credentials and manually access a system.

Stolen VPN Credentials

Weak or compromised VPN credentials can provide direct network access.

Exploited Vulnerabilities

Unpatched:

• VPN appliances
• Firewalls
• Web applications
• Servers
• Remote management software

may provide initial access.

Compromised Administrator Accounts

Credential theft can give attackers extensive access to the network.

22. Look for Data Exfiltration

Modern ransomware attacks increasingly involve more than encryption.

An attacker may:

Enter network
     ↓
Steal credentials
     ↓
Move laterally
     ↓
Collect sensitive information
     ↓
Exfiltrate data
     ↓
Destroy backups
     ↓
Deploy ransomware

This is commonly called double extortion when attackers threaten to publish stolen information in addition to demanding payment for decryption.

Therefore, organizations should investigate whether information was accessed or exfiltrated, not merely whether files were encrypted.

23. Run Security Scans—but at the Correct Stage

Once evidence has been preserved and investigation has begun, security tools can be used to identify malicious components.

Possible tools include:

• Microsoft Defender Antivirus
• Microsoft Defender for Endpoint
• Enterprise EDR/XDR
• Offline antivirus scanners
• Organization-approved forensic tools

Microsoft recommends full current antivirus scanning of suspected systems as part of ransomware eradication.

However, immediately deleting everything detected by antivirus before forensic evidence is collected can interfere with an investigation.

24. When Should the Computer Be Reconnected?

Do not reconnect the computer simply because encryption appears to have stopped.

Reconnect only after reasonable confidence exists that:

• Ransomware has been removed
• Persistence has been removed
• Credentials have been secured
• Security updates are installed
• Vulnerabilities are remediated
• EDR/antivirus is operational
• Network indicators have been reviewed
• Other affected systems have been identified
• The computer is considered safe

In many serious incidents, rebuilding the affected endpoint from a known-good image is safer than attempting to clean it manually.

Recommended Ransomware Emergency Sequence

A practical high-level response sequence is:

1. Detect suspicious ransomware activity
                ↓
2. Disconnect affected systems from network
                ↓
3. Contain affected network segments if necessary
                ↓
4. Protect backup infrastructure
                ↓
5. Preserve forensic evidence
                ↓
6. Document affected systems and accounts
                ↓
7. Determine attack scope
                ↓
8. Identify initial access and persistence
                ↓
9. Secure compromised credentials
                ↓
10. Eradicate malware and attacker access
                ↓
11. Patch vulnerabilities
                ↓
12. Validate clean backups
                ↓
13. Rebuild/clean affected systems
                ↓
14. Restore data
                ↓
15. Monitor carefully
                ↓
16. Gradually return systems to production

What Not to Do After Discovering Ransomware

Avoid these common mistakes:

• Do not leave the infected computer connected to the network.
• Do not immediately reconnect it after restarting.
• Do not start deleting encrypted files.
• Do not delete ransom notes.
• Do not immediately format every affected computer.
• Do not immediately restore backups into an untrusted network.
• Do not assume only one computer is affected.
• Do not assume backups are clean.
• Do not assume encryption is the attacker's only activity.
• Do not communicate sensitive response plans through systems suspected of being monitored by the attacker.

CISA specifically warns that attackers may monitor organizational communications during an incident and recommends coordinated isolation and, where appropriate, out-of-band communications.

Small Business Example

Suppose a company has:

20 Windows PCs
1 Windows Server
1 Domain Controller
1 NAS
1 Backup Server
Microsoft 365

An employee reports that documents suddenly have strange extensions and a ransom note appears.

A reasonable initial response would be:

Step 1: Disconnect that PC from Ethernet and Wi-Fi.

Step 2: Determine whether other computers show similar activity.

Step 3: Check file servers and shared folders for recent mass modifications.

Step 4: Protect backup infrastructure from further access.

Step 5: Review Active Directory, endpoint security, firewall, VPN and remote-access logs.

Step 6: Identify suspicious or compromised accounts.

Step 7: Preserve ransom notes, encrypted file samples and relevant logs.

Step 8: Determine the ransomware entry point and scope.

Step 9: Remove attacker persistence and remediate vulnerabilities.

Step 10: Restore data only after establishing a trusted recovery environment.

Frequently Asked Questions (FAQ)

1. What should I do first after discovering ransomware?

Immediately isolate the affected computer from the network. Disconnect Ethernet, Wi-Fi and unnecessary network connectivity to reduce the possibility of additional lateral movement or encryption. CISA lists immediate isolation of impacted systems as a primary ransomware response action.

2. Should I disconnect a ransomware-infected computer from the Internet?

Yes, but disconnecting only Internet access may not be sufficient. The computer should generally be isolated from the local network as well.

3. Should I unplug the Ethernet cable?

Yes. If Ethernet is the machine's network connection, physically unplugging the cable is a fast and effective isolation method.

4. Should I turn off Wi-Fi?

Yes. Disable Wi-Fi to prevent the compromised system from communicating through the wireless network.

5. Should I immediately shut down the ransomware-infected computer?

Not necessarily. Where possible, isolate it without shutting it down so volatile forensic evidence can be preserved. If network isolation is impossible and the system is actively causing additional damage, powering it down may be necessary.

6. Can ransomware spread to other computers?

Yes. Depending on the ransomware campaign and attacker access, compromise can spread through network services, stolen credentials, remote administration, shared resources or vulnerabilities.

7. Can ransomware encrypt network drives?

Yes. If the compromised user or system can write to mapped network drives or shared folders, ransomware may encrypt accessible files.

8. Can ransomware infect a NAS?

NAS data can be encrypted or deleted if attackers obtain sufficient access. Some ransomware campaigns also target NAS platforms directly.

9. Should I disconnect the backup server?

If the attack is active and the backup infrastructure may be reachable by compromised systems or accounts, isolating online backup infrastructure can protect recovery assets.

10. Should I delete encrypted files?

Normally, no. Preserve them until recovery possibilities and forensic requirements have been evaluated.

11. Should I delete the ransom note?

No. Preserve it as evidence.

12. Should I format the infected computer?

Rebuilding may ultimately be appropriate, but first preserve necessary evidence and investigate the attack's scope and root cause.

13. Can antivirus remove ransomware?

Security software may detect and remove ransomware components, but removing malware does not automatically decrypt files or prove that all attacker persistence has been eliminated.

14. Can Microsoft Defender isolate a ransomware-infected computer?

Microsoft Defender for Endpoint supports device isolation, which restricts network communication while retaining appropriate Defender service connectivity.

15. Should passwords be changed after ransomware?

Compromised credentials generally need remediation. In an enterprise incident, however, credential resets should be coordinated so new passwords are not exposed to attacker-controlled systems.

16. Can ransomware steal data before encrypting files?

Yes. Modern ransomware incidents may include data theft before encryption, so organizations should investigate possible data exfiltration.

17. Should OneDrive synchronization be stopped?

If ransomware is encrypting files in synchronized directories, pausing synchronization may help prevent damaged versions from propagating while the incident is investigated.

18. When can I restore my backups?

Restore only after establishing a trusted environment, addressing the initial attack vector, securing compromised accounts, validating backups and removing attacker persistence.

19. Can ransomware come back after restoring a backup?

Yes. Reinfection is possible if the vulnerability, compromised credentials, malicious persistence or another infected system remains in the environment.

20. What is the most important ransomware response rule?

Contain first, investigate carefully, eradicate the attacker, and restore only into a trusted environment.

A fast but uncontrolled recovery can reintroduce the same compromise. Proper ransomware response should treat the event as a potentially network-wide security incident rather than simply an encrypted-files problem.

Conclusion

When ransomware is discovered, the infected computer should normally be disconnected from the network immediately. Network isolation can reduce lateral movement, prevent access to shared resources, limit further encryption and make it harder for an attacker to continue controlling the compromised endpoint.

However, disconnecting the computer is only the beginning.

A complete ransomware response should include containment, evidence preservation, scope determination, credential protection, backup isolation, forensic investigation, eradication, vulnerability remediation, clean restoration and post-recovery monitoring.

For businesses—particularly those operating Windows domains, Remote Desktop environments, shared file servers, NAS devices, accounting applications and centralized backup systems—a ransomware alert on a single workstation should initially be treated as a potential organization-wide compromise until investigation demonstrates otherwise.

Tags

#Ransomware #RansomwareAttack #RansomwareResponse #RansomwareRecovery #RansomwareProtection #RansomwarePrevention #RansomwareRemoval #RansomwareSecurity #CyberSecurity #CyberAttack #CyberThreat #Malware #MalwareAttack #IncidentResponse #CyberIncident #NetworkSecurity #EndpointSecurity #NetworkIsolation #DeviceIsolation #WindowsSecurity #WindowsRansomware #MicrosoftDefender #DefenderForEndpoint #DataRecovery #BackupSecurity #OfflineBackup #ImmutableBackup #DisasterRecovery #BusinessContinuity #DataProtection #DataEncryption #EncryptedFiles #RansomwareEncryption #NetworkProtection #ActiveDirectory #DomainController #WindowsServer #FileServer #NAS #NetworkShares #CloudBackup #OneDrive #RemoteDesktop #RDP #VPN #CyberForensics #DigitalForensics #ThreatDetection #ThreatResponse #ITSecurity