What are the immediate steps to take during an active ransomware attack?

All answers to this question.

The most urgent step is isolation. You need to disconnect the affected systems from the network immediately, but do not shut them down as you might lose volatile memory evidence needed for forensics. Disconnect the WiFi and pull the ethernet cables. Next, disable all RDP ports and change administrative passwords across the board. Since you’re worried about exfiltration, check your firewall logs for large outbound data spikes to identify the "command and control" (C2) servers. Once isolated, you can begin the process of identifying the entry point and assessing the integrity of your backups.

   Answered 2025-06-07 by Jennifer Clark

Do you have an immutable backup solution in place, or are your backups connected to the same domain as your primary servers?

   Answered 2025-06-10 by Michael Taylor

• Michael, that is a vital distinction. If backups are on the same domain, the ransomware will likely encrypt them too. If they aren't immutable, the attackers might have deleted them weeks ago before triggering the payload. It’s best to verify backup integrity from an air-gapped environment before attempting any restoration. This prevents re-infection during the recovery phase, which is a common mistake for small teams.

     Commented 2025-06-12 by Christopher Lee

You should immediately call your cyber insurance provider and a legal team. They often have incident response experts who can guide you through the crisis.

   Answered 2025-06-15 by Barbara Hall

• Great advice, Barbara. Many people forget that the legal and insurance requirements are just as important as the technical ones to ensure coverage and compliance.

     Commented 2025-06-16 by Linda Martinez