Ransomware: warning signs and what to do immediately

Ransomware is malware that locks (encrypts) your files and then demands payment to unlock them. Acting quickly in the first few minutes can keep it from spreading to other computers and shared files.

Warning signs

• Files suddenly won't open, or their names have changed and end in a strange extension (for example report.docx.locked).
• A new text file, web page or wallpaper appears with instructions to pay, often in cryptocurrency.
• Many files in a shared folder or OneDrive change at the same time.
• The computer becomes extremely slow while the hard drive is constantly busy.
• Your antivirus has been turned off, or you see security alerts you don't recognize.

What to do right now

1. Disconnect from the network. Unplug the network cable and turn off Wi-Fi. This helps stop the ransomware from reaching other computers, servers and shared drives.
2. Don't shut the computer down unless we ask you to. Leaving it on but disconnected can preserve information that helps with the investigation and recovery.
3. Don't delete, rename or "clean up" anything. Don't run cleaning tools or try to restore files yourself yet. You could destroy evidence or the files needed to recover.
4. Don't pay and don't contact the attackers. Paying doesn't guarantee you will get your files back, and it can mark you as a target for future attacks.
5. Preserve evidence. Take a photo of the ransom message with your phone and write down the time you first noticed the problem and what you were doing.
6. Contact us immediately. Open a ticket at support.elitechforce.com or email [email protected], using a different device that is not affected. Mark it as urgent and mention "ransomware".
7. Warn your coworkers. Ask them not to open shared files until we've checked the situation.

Report the incident

Ransomware is a crime. In the United States you can report it to the FBI's Internet Crime Complaint Center at ic3.gov. If customer or employee information may have been exposed, you may have legal notification obligations; your attorney or insurer can advise you, and having a clear record of what happened helps.

How to prevent it

• Backups: keep automatic backups with at least one copy that is offline or protected from changes, and test restoring files regularly. A good backup is what turns a disaster into an inconvenience.
• Multi-factor authentication (MFA): turn it on for email, Microsoft 365, remote access and any cloud service. Stolen passwords are a common way attackers get in.
• Updates: keep Windows, macOS, browsers and programs up to date.
• Standard user accounts: don't use an administrator account for everyday work.
• Training: most ransomware starts with a phishing email. Make sure everyone on your team knows how to spot one.

Published on - 01-01-1970 05:30am