Ransomware response experts who get your data back

Three things, and the order matters more than the speed.

1. Isolate. Unplug the affected hosts or isolate their switch ports, and cut every connection to shared drives, virtualization platforms, backup servers and external disks. Isolate, but do not power off or shut down.
2. Stop. No reboot, no reinstall, no formatting, no disk check or repair utilities, and no immediate full-disk antivirus cleanup.
3. Preserve. Keep the original ransom note, keep encrypted samples, keep firewall and VPN logs, and pause every automated backup or sync job that could overwrite data.

Then make the call. A great deal of irreversible data loss is caused not by the malware but by the rescue attempts made in the hours after discovery.

Rebooting has several consequences that are hard to undo:

• Memory evidence disappears. Some families keep key material or decryption-related structures in memory; once the host is powered down that content is gone, and forensics loses a key source.
• Encryption may continue or accelerate. Some encryptors set themselves to run at startup, so a reboot triggers encryption of whatever is left.
• System writes overwrite remnants. Boot writes logs, temporary files and the page file, potentially overwriting unencrypted remnant data that was still extractable.
• Disk self-check rewrites structures. After an unclean shutdown the system may automatically run a disk check, rewriting filesystem structures and further reducing recoverability.

The right move is to keep the power on and pull the network, then wait for a professional judgement.

Not yet. The ransom note is one of the most direct inputs to family identification — the filename pattern, wording, contact format and ID encoding all feed into it, and identifying the family and version is what determines whether a decryption path exists at all.

A full antivirus cleanup should also wait. Cleanup can remove key files, configuration files, the note itself and samples of the attacker's tooling — which are both identification inputs and critical forensic evidence. In some cases what gets deleted is precisely the material recovery depended on.

The right order is: isolate, preserve evidence, then eradicate under professional guidance. If your antivirus has already quarantined files, keep the quarantine record and do not empty the quarantine.

We advise against making contact and we do not make it on your behalf. Deadlines, price increases and limited-time discounts are standard scripts designed to create time pressure and push victims past assessment straight into a transaction.

In practice:

• making contact confirms you are a staffed, funded target, which can raise the price and invite further pressure;
• payment does not guarantee a working decryptor, nor that stolen data is deleted;
• moving funds to overseas attackers carries its own compliance exposure.

A better use of that time is inventorying data sources: backups, storage snapshots, hypervisor snapshots, local copies on endpoints, historical exports. In a significant share of cases these overlooked sources are what recovery ultimately rests on.

A few signals help:

• New encrypted files. Watch a directory on an already-isolated host; if extensions keep appearing, a process is still running locally.
• Hosts falling one after another. Ransom notes appearing on different machines at different times usually means the actor is still moving through the network rather than having deployed once.
• Anomalous account activity: unfamiliar logons on domain controllers, bulk policy pushes, new scheduled tasks.
• Backup jobs terminating unexpectedly, shadow copies being deleted, antivirus being disabled.

While any of these persists, treat the incident as ongoing: widen isolation, disable suspicious accounts, rotate privileged credentials, and do not return restored systems to the production network until eradication is complete — being encrypted again after a restore is the most common and most avoidable second loss.