What should we do first if we see these signs?
Disconnect the affected hosts from the network, keep their logs, reset the credentials used on them and call your incident-response provider. If your organisation is in scope of NIS2NIS2: the EU's second Network and Information Security directive. The EU cybersecurity law (Directive (EU) 2022/2555) that sets security and incident-reporting duties for many companies., the 24-hour early warning starts when you become aware of a significant incident.
This answer also appears, with more context, here: Detect ransomware on the network
Read next
Related questions
Terms used here
- NIS2 (the EU's second Network and Information Security directive)
- The EU cybersecurity law (Directive (EU) 2022/2555) that sets security and incident-reporting duties for many companies.