What to do when you are getting crypto ransomware attack?
Isolate devices
The first thing you should do is identify the computer that the malware is on and isolate the infection. When the hacker attacks their goal is to have their malware spread throughout the network (WiFi) and encrypt valuable data. By isolating the infection, you can stop the malware from spreading to other computers and storage devices. Then disconnect all your storage devices network, and make sure nothing is connecting to your storage devices.
Scan
Scan all the devices. There is a really high chance of than more than one computer that is being attacked. Any devices that might be infected, disconnect right away.
Identify
Many crypto-ransomware attacks are plan attacks. Try to think about what they are going after. This could help you in the long run, if you know what they are going after you can make a countermeasure.
Report to authorities.
When you are done with the first two, contact the authorities. Try to contact the FBI and explain the situation to them. Reporting can provide law enforcement with a greater understanding of the situation. Having an expert beside you is better than doing this alone.
Options
Usually, when you are done with all of the steps there are only 3 options left.
The first option is to pay the ransom. But most law enforcement agencies urge you not to pay ransomware attackers, doing so will only encourage hackers to create more ransomware. And even if you decide to pay, there is a possibility that they won’t return the data.
The second option is to remove the malware. If you try to remove the malware, there is a very high chance of you failing. There is no perfect solution for how to remove it completely without taking risks. And there is a possibility that not all malware is removed.
The third option is the most optimum, and that is restart and reinstall. Restarting and reinstalling means that you are wiping out everything, all files. Many companies do a regular backup. And always has a full system back backup once a month. They tend to just reboot the system and get their files back.
