---
name: ransomware-first-response
description: "Handle the first hour of a suspected ransomware or malware infection calmly and correctly — contain it, preserve options, and avoid the moves that make it worse. Use when asked what to do about ransomware, my files are encrypted with a ransom note, I think I have malware, or my computer's been hacked. Produces an immediate containment checklist, a preserve-evidence-and-options step, a recovery path (backups, known decryptors, professional help), guidance on the ransom-payment decision, and reporting steps — for personal/small-setup use, not a substitute for professional incident response."
---

# Ransomware First Response

The first hour decides how bad a ransomware or malware incident gets. Panic leads to the wrong moves — paying immediately, wiping evidence, or reconnecting an infected machine and spreading it. This gives a calm, correct sequence: isolate, preserve your options, and recover from the safest source — while being honest that a serious business incident needs professional responders.

## What This Skill Produces

- **Immediate containment** — disconnect from networks and shared drives to stop spread, without destroying recovery options
- **Preserve evidence & options** — don't wipe or pay reflexively; photograph the ransom note, note timing, keep the door open
- **The recovery path** — restore from clean offline backups, check for a known/legitimate decryptor, or engage a professional
- **The payment decision** — the honest tradeoffs and risks of paying (no guarantee, funds crime, marks you as payer)
- **Reporting** — the authorities/agencies to notify, and (for orgs) any breach-notification duties
- **A scope flag** — personal/small setup vs. a business incident that needs real incident-response help

## Required Inputs

Ask for these if not provided:
- **What you're seeing** — ransom note, encrypted/renamed files, pop-ups, or just suspicious behavior
- **The setup** — personal device, home network, or a business/multi-device environment
- **Backups** — do you have recent offline/cloud backups, and are they disconnected
- **Spread** — is it one device or possibly shared drives/other machines
- **Sensitivity** — is sensitive/regulated data involved

## Framework: Isolate, Preserve, Recover — Don't Panic

1. **Isolate now.** Disconnect the device from Wi-Fi/network and unplug shared/external drives to stop encryption from spreading — but don't start deleting.
2. **Don't destroy your options.** Don't wipe, don't reformat yet, and don't pay on impulse. Photograph the ransom note and record what/when you noticed.
3. **Recover from clean backups.** The best outcome is wiping and restoring from a known-good *offline* backup — verify it wasn't connected during infection.
4. **Check for legitimate decryptors.** Some ransomware strains have free, reputable decryptors via official security projects — check before considering payment.
5. **Weigh payment honestly.** Paying is risky: no guarantee of recovery, it funds criminals, and it flags you. Treat it as a last resort, ideally with professional advice.
6. **Report and, if serious, get help.** Notify the relevant authorities; for a business or sensitive-data incident, engage professional incident response and check notification duties.

## Output Format

### Suspected [ransomware/malware] · [personal/business] · backups: [yes/no]

**Now (first minutes)**
1. Disconnect network + unplug external/shared drives.
2. Don't wipe, don't pay yet. Photograph the ransom note; note time/first sign.
3. Isolate any other devices that share the network/drives.

**Recover:** wipe + restore from a clean *offline* backup → or check for a legitimate free decryptor → or engage a professional.
**Payment:** last resort, high risk — [tradeoffs]; get advice first.
**Report:** [relevant authority/agency] · [breach-notification duties if applicable].

> This is first-response guidance for a personal/small setup. A business incident, or anything with sensitive/regulated data, needs professional incident responders — engage them early.

## Quality Checks
- [ ] Containment (disconnect network/drives) is the first action
- [ ] Warns against wiping or paying reflexively; preserve evidence
- [ ] Prioritizes restoring from a verified offline backup
- [ ] Mentions checking for legitimate free decryptors before payment
- [ ] Presents the payment decision honestly as a risky last resort
- [ ] Includes reporting and flags when to get professional IR help

## Anti-Patterns
- **Paying immediately** out of panic.
- **Reformatting/wiping** before preserving evidence and confirming backups.
- **Reconnecting the infected device** and spreading it.
- **Restoring from a backup** that was connected during infection.
- **Treating a serious business breach** as a DIY job.

## Example Trigger Phrases
- "My files are all encrypted and there's a ransom note — what do I do?"
- "I think I've got ransomware, help me not make it worse."
- "Suspicious pop-up locked my computer demanding payment."
- "Should I pay the ransom to get my files back?"
- "Malware on my work laptop — what's my first move?"