Suspected ransomware: isolate first and preserve recovery options

In brief

Suddenly inaccessible files, unusual renamed extensions and a ransom note can indicate ransomware, but not every file error is an infection. If you suspect active encryption, isolate the device from the network promptly.

The first goal is containment and preserving recoverable data, not trying random decryptors on your only files.

Contain without improvising a cleanup

Disconnect Ethernet and Wi-Fi where possible. CISA advises powering down if network isolation cannot be achieved; otherwise incident professionals may need the running state for evidence. On a managed device, follow the team’s instructions rather than continuing normal work or rebooting repeatedly.

Protect the recovery material

Do not plug in the only backup to see whether it works. Keep separate copies of affected data where competent responders direct, and avoid testing unknown tools from ransom-message links. A genuine decryptor is specific to a threat and case; it is not proof that every encrypted file can be restored.

Recover after the cause is addressed

Use a known clean environment and a verified backup under appropriate guidance. Review credentials and access that might have been stolen as well as encrypted files. Record missing data and report through the relevant official channels; restoring a folder does not establish that the attacker’s access is gone.

What to do next

1. Disconnect network access and avoid attaching backup drives to the affected device.
2. Inform the responsible support team and preserve the note, error and timing without distributing active files.
3. Use a clean device to protect relevant accounts and plan restoration only after the incident is contained.