
Forensic technicians can ensure systems aren’t compromised in other ways, gather information to better protect organisations going forward, and try to track down the attackers. Ĭryptolocker ransomware attacks are a crime, and organisations should call law enforcement if they fall victim. That decision should be based on the type of attack, who in your network has been compromised, and what network permissions the holders of compromised accounts have.

Only the IT security team should attempt a reboot.Ĭentral to your response is whether to pay the ransom.

If possible, they should physically take the computer they’ve been using to their IT department. Once your users detect a ransomware demand or virus, they should immediately disconnect from the network.
