What to do when the worst happens
Anonymous Security Expert
VanderNet Security Team
Key Takeaways
- 1.Disconnect from the network immediately — but don't power off the device
- 2.Modern ransomware copies data, so backups alone won't prevent data leaks
- 3.Avoid installing software from unverified sources to prevent infection
Uh oh! A message has popped up on your computer alerting you that you've been compromised with a virus and you only have 72 hours to pay up in order to save your files lest they be lost forever. You've become victim of ransomware. Distinct from Scareware where users are socially engineered into believing they've been hacked, a Ransomware notification is the final stage of an already successful attack. The damage has already started and it is important to take immediate actions to minimize the impact this situation has on the business.
The first steps in dealing with a terminal case of Ransomware is preventing the spread of the attack as much as possible and preserving evidence for future analysis. Users who have fallen victim for Ransomware should first disconnect their device from the network as quickly as possible. It may be tempting to shut off computer or unplug it from power but this also may destroy important evidence and logs that your IT team will want to collect while remedying the situation. So, it is better to unplug any Ethernet cables from your device as well as put the device in airplane mode if it has any wireless capabilities while leaving the device powered on. After immediately disconnecting the computer, next you need to contact both your IT department through the highest priority channel you can as well as inform your immediate supervisor. At this stage the ransomware has likely propagated to other computers, and it is important that you and your team is on the look out for further signs of compromise. Follow any additional instructions your IT provides and assume any flash drives or removable media may be infected and should not be used.
Ransomware affects all companies big and small and affects more than just holding your files for ransom. Modern ransomware not only prevents you from accessing your data but also copies that data so even if your IT company is able to restore your systems from a backup proprietary and sensitive information is still at risk of being leaked or sold on the dark web. Even paying the ransom will not guarantee hackers won't go behind your back and sell your information to the highest bidder. To avoid ransomware, it is best to keep the following in mind. Ransomware is most often spread by installation of morally grey software. Free versions of normally premium software products, stolen media and movie downloads, or get rich quick browser extensions. As such never download any applications or install browser extension unless they come from reputable vendors and only from their official sources. Make sure your computers are equipped with Anti-virus and Zero Trust application whitelisting software. Never plug unfamiliar thumb drives into your device. With these tips in mind, you will be better prepared to survive out there in a world increasingly infested with ransomware.
~ Your friendly village IT wizard
Even paying the ransom will not guarantee hackers won't go behind your back and sell your information to the highest bidder.
Want a personalized risk assessment?
Get a clearer view of where your IT, security, and support strategy stand today.
Anonymous Security Expert
VanderNet Security Team
Our anonymous security expert brings deep frontline experience in incident response and ransomware remediation, sharing practical guidance from real-world engagements.
