What to do if your computer is infected with ransomware?

Disconnect the device from the network immediately to stop the ransomware from spreading or reaching shared storage, but do not power it off if responders may need volatile evidence. Do not pay the ransom, and report the incident to your security team and the relevant authorities.

Then recover from a backup you have verified is clean rather than the most recent one, which may already be compromised. For organizations, the key is knowing in advance which recovery points are clean — Elastio inspects backups continuously so the last known clean copy is identified before an incident, not discovered during one.