What to Do if Your Enterprise is Attacked by Ransomware

1. Remove infected hosts or devices from the network in order to contain the ransomware.
2. Confirm with the anti-virus software or endpoint protection provider(EDR) and collect relevant evidence. By collecting key data, it’ll help enterprises understand the type of ransomware and possible intrusion methods. Then, enterprises can try to remove the malware, block the attack chain, and patch the vulnerabilities before doing system restore and data recovery operations. .
3. Update critical system passwords, particularly those for network management or system access accounts that external parties can reach. This helps prevent or reduce the risk of intruders using compromised credentials to access the system and carry out unauthorized actions.
4. Immediately notify relevant customers or partners to avoid losses caused by commercial fraud emails or personal fraud incidents.

Contact us for incident response service: https://teamt5.org/en/contact-us/