To thwart recovery efforts, many modern ransomware strains will specifically target a company’s backups and try to encrypt, override or delete them.

While backups play a crucial role in remediation, it’s important to remember that they are not immune to ransomware. To contain the infection and prevent the ransomware from spreading, infected systems must be removed from the network as soon as possible. The vast majority of ransomware will scan the target network, encrypt files stored on network shares and try to propagate laterally to other systems. Isolation should be considered top priority. If preventative measures fail, organizations should take the following steps immediately after identifying a ransomware infection. In this guide, we’re going to discuss in detail exactly how businesses should respond to a ransomware attack and explore preventative measures that can help reduce the risk of infection. It can mean the difference between a company-wide infection and a contained incident the difference between swift remediation and permanent business closure. In the event of a ransomware attack, an effective response plan can mean the difference between panic and decisive action.

Users compromised by crypto locker