How do we restore from backup safely after ransomware?
Do not start restoring until you know how the attackers got in and have closed that route, otherwise you restore into a network they still control. Then work in order: rebuild or verify a clean backup server and restore console first, with new credentials; change all administrator and service account passwords, including those used by the backup software; restore systems into an isolated network segment, not straight back onto production; choose a restore point from before the intrusion began, not just before the encryption; scan the restored systems and check for unexpected accounts, scheduled tasks and remote-access tools; and reconnect them step by step while watching their network behaviour. Keep the encrypted originals untouched until you are sure, both as evidence and in case a decryptor becomes available. With NetSenX in place, restored hosts that start regular outbound check-ins or unusual internal connections show up in the alerts.