Affected systems should be isolated to prevent the incident from spreading. Organizations should preserve copies of encrypted files and investigate whether legitimate recovery tools or clean backups are available.
Paying a ransom does not guarantee that files will be recovered and can create additional risks. Where possible... Read more