A ransomware attack is usually the visible end of a longer intrusion. An attacker gets in, explores, steals data, removes your recovery options and then encrypts systems. If you suspect one, isolate affected systems in a coordinated way, communicate out of band, and follow your response plan rather than improvising.
What are the stages of an attack?
CISA's joint guide with the NSA, FBI and MS-ISAC describes the pattern in its prevention section, which is organized by how attackers get initial access: internet-facing vulnerabilities and misconfigurations, compromised credentials, phishing, precursor malware infections, advanced social engineering, and third parties or managed service providers.
After access, attackers typically move through the network and look for valuable data and for backups. The guide notes that many ransomware variants search for accessible backups to delete or encrypt, so restoring without paying becomes impossible. Many actors also steal data first. CISA calls encrypting and stealing together double extortion, and notes some actors skip the encryption and threaten to publish stolen data alone.
An important detail from the guide: a ransomware event may be evidence of an earlier, unresolved compromise. Operators of precursor malware often sell access to a network, which means the group that encrypts your files may not be the group that first got in.
What should you do in the first hour?
The response checklist in CISA's guide says to move through the first three steps in sequence.
First, determine which systems are affected and isolate them. If several systems or subnets look impacted, take the network offline at the switch level. If that is not possible, unplug affected devices or remove them from Wi-Fi. For cloud resources, snapshot volumes so you have a point-in-time copy for forensics.
Second, be careful how you coordinate. Attackers may be watching your communications to see if they have been detected. The guide advises isolating in a coordinated manner and using out-of-band communication such as phone calls so you do not tip them off and trigger wider deployment.
Third, power down devices only if you cannot disconnect them, because doing so destroys evidence in volatile memory.
After that: triage systems for restoration using a predefined critical asset list, and review detection and prevention logs for earlier stages such as dropper malware.
Which preparations matter most?
Backups come first, and the details matter. CISA recommends maintaining offline, encrypted backups of critical data and regularly testing availability and integrity in a disaster recovery scenario. It also recommends keeping updated "golden images" of critical systems so you can rebuild.
Next is the front door: do not expose remote desktop on the web, disable unneeded protocols on internet-facing assets, scan regularly for vulnerabilities, and implement phishing-resistant MFA for email, VPNs and accounts that reach critical systems.
Last is the plan itself. CISA's small business guidance says to invoke the incident response plan even for a suspected false alarm, because near misses improve the plan.
A constructed example
At 02:10 on a Sunday, a monitoring alert shows a file server renaming thousands of files. The on-call engineer does not reboot it. She phones the incident lead rather than posting in the usual chat, since the chat is on the same network. The two agree to take the finance subnet offline at its switch, then snapshot the cloud-hosted database volumes. By morning, the team has a list of affected hosts, a copy of the encrypted file server, and a restore plan that starts with the three systems on the critical asset list. The offline backup from Thursday is intact, because it was never reachable from the production network.
How to check or apply this
- Keep one backup copy offline, encrypted, and test a full restore on a schedule.
- Record a critical asset list with restore order and owners.
- Write down who can order a network isolation, and how to do it at the switch or cloud console.
- List out-of-band contacts: personal phones, an alternate chat or email, printed numbers.
- Remove internet exposure of remote access services, and require MFA on all that remain.
- Exercise the plan in a tabletop session with a ransomware scenario.
Quick check
Should we power off an infected machine immediately?
Only if you cannot disconnect it from the network. CISA's checklist treats power-down as a last resort because it loses evidence held in memory.
Does paying the ransom guarantee recovery?
No source we fetched promises that. Treat payment as a legal, financial and law enforcement question to take to counsel and authorities, not as a recovery plan.
Sources
Last reviewed: 18 October 2026.
