In a ransomware attack, first find the affected systems and isolate them in a coordinated way, using communication the attacker cannot read. Then preserve evidence, hunt for how they got in, and restore critical systems from clean offline backups on a clean network. CISA's #StopRansomware guide sets out this order.
What comes first?
CISA's response checklist begins with detection and analysis. Determine which systems were impacted and isolate them immediately. If several systems or subnets look affected, it suggests taking the network offline at the switch level, since disconnecting systems one by one may not be feasible mid incident. If that is not immediately possible, unplug affected devices or remove them from Wi-Fi. For cloud resources, take a snapshot of volumes for later forensic review.
The guide adds a point many teams miss: after an initial compromise, attackers may be watching your communications to learn whether they have been detected. It advises isolating systems in a coordinated manner and using out-of-band communication such as phone calls, because tipping them off can lead them to move laterally to preserve access or to deploy ransomware widely before the network is offline.
Should you power machines off?
Only as a last resort. The guide says to power down devices if you cannot disconnect them, to avoid further spread, but notes this loses artifacts and evidence held in volatile memory and should be done only when other means of disconnecting fail.
How do you decide what to restore first?
Triage in advance, not in the middle of the incident. CISA advises prioritizing restoration using a predefined critical asset list covering systems critical to health and safety, revenue generation or other essential services, plus the systems they depend on. It also advises tracking the systems that appear unaffected so they can be deprioritized, which gets the organization back to business more efficiently.
Why is the ransom note often not the start?
The guide says a ransomware event may be evidence of a previous, unresolved compromise. It points to precursor "dropper" malware, and notes that operators of such malware often sell access to a network, and that actors sometimes steal data first and threaten to release it before demanding a ransom. It warns that care must be taken to identify such malware before rebuilding from backups, to prevent continuing compromise. If you restore without finding the way in, you may restore the intruder with it.
What should the hunt look for?
CISA's enterprise checklist includes newly created Active Directory accounts or accounts with escalated privileges, anomalous VPN or other suspicious logins, changes that impair backups, shadow copies or boot configurations, signs of Cobalt Strike, unexpected remote monitoring and management software, and unexpected PowerShell execution. These are indicators from the guide, not a complete list.
What makes recovery possible at all?
Preparation. The guide's first recommendation is to maintain offline, encrypted backups of critical data and to test them, since many ransomware variants try to find and delete or encrypt accessible backups. It also advises keeping golden images of critical systems and using infrastructure as code, version controlled and audited, with template backups kept offline so cloud resources can be redeployed quickly.
A constructed example
A regional distributor's file servers start encrypting on a Saturday night. The on call engineer calls the IT lead by phone, not chat. They pull the switch uplink for the server VLAN, snapshot the cloud volumes, and leave the affected hosts running to preserve memory. On Sunday the team reviews logs and finds a VPN login from a contractor account two weeks earlier and a new remote management tool on the domain controller. They rebuild the domain controller from a golden image, reset the credentials, and only then restore the order system from last Thursday's offline backup, which they had tested in the spring.
How to check or apply this
- Write the first hour as a one page checklist and put it where people can find it when systems are down.
- Agree an out-of-band way to reach each other.
- Keep offline, encrypted backups and test a restore each quarter.
- Keep a ranked list of critical systems and their dependencies.
- Keep golden images and infrastructure as code templates offline.
- Know whom to call: your legal counsel, insurer, and the relevant law enforcement contacts. The CISA guide recommends knowing your local FBI field office contact beforehand.
- After recovery, review what let it happen and fix that first.
Quick check
Should you restore from backup immediately?
Not before you find how the attacker got in. CISA warns that dropper malware or stolen access can cause a repeat compromise if you rebuild without finding it.
Why use phone calls during an incident?
Attackers may monitor email and chat to see whether they have been noticed. CISA advises out-of-band communication to avoid tipping them off.
Sources
Last reviewed: 18 October 2026.
