Office workers' computers suddenly show only a black screen with 'decrypting' text — is it ransomware?

ransomware is really bad stuff man.. and shut down the network immediately dont pay. anyway i have some IT know-how call for forensic analysis, i checked later therees a recovery tool but it only worked on 3 folders...

edit: I wrote something wrong above, sorry about that.

Identifying the ransomware vector is important: 1) Email phishing, 2) RDP exploit, 3) VPN vulnerability, 4) Supply chain (contractor), 5) USB portable media. Analyze the attacker's note (ransom note file, .txt) to determine the encryption algorithm. Some ransomware types (Wannacry, Petya etc.) have known decryption keys — you can use the ID Ransomware tool (id-ransomware.malwarehunterteam.com). Capture network logs: /var/log/auth.log, Windows Event Log (Eventid 4697, 4688).

this is exactly why you do backups bro. or wait a sec... is this 0.5 bitcoin more valuable than the database? never pay, because they often don't unlock it and the police will cause you a lot of trouble too. cut the network immediately, restore from backup, done.

Ransomware prevention and response plan: 1) Immutable backups (3-2-1 rule: 3 copies, 2 media, 1 offsite), 2) Air-gapped backup system (disconnected from the network), 3) EDR (Endpoint Detection and Response) solution, 4) Zero Trust Network Access, 5) Incident Response Plan, 6) Cyber insurance. If this attack has already happened, you're not completely screwed — plan to restore from backup, check version histories, do incremental recovery.

Ransomware = 'Please end me' deadlock 😂 But seriously, shut down the network call the police, call insurance. anyway even if you pay the ransom, they won't unlock it and your email address is on 10 million other devices...

Let me summarize what's been said so far. Everything goes well for the first three months; problems arise in the fourth.

Hasty decisions become decisions you have to fix six months later. If you post the result here, it will help others too.

i've been dealing with this for a long time. taking measures without an inventory leaves dors you haven't seen open.

just leaving this note it might be useful.

How did you solve this? Security isn't absolute; it's about making attacks not worth the effort.

Same here.

Let me clarify the technical side. When you try to change everything at once nothing settles.

We need to make a distinction here. Trying to do this alone is the most expensive way.

Taking measures without an inventory leaves doors you haven't seen open. Proven by experience.

There's a trap here, let me mention it. Taking measures without an inventory leaves doors you haven't seen open.

Good luck with that.

I was thinking the same thing. If permission and scope aren't in writing, don't start that test.

Proven by experience.

Let me speak from the other side; I'm on the supplier side. The real issue isn't the number but what it's based on.

Just leaving this note, it might be useful.

Just a heads-up. People defend habits, not processes. Resistance comes from there.

Taking notes for two weeks yields better results than a six-month estimate. Of course, it varies if your situation is different.

Generally correct, but one part is missing. An untested backup is not a backup.

Start with a small trial; don't commit to everything at once. I'm also curious if anyone does it differently.

There's one point I'm curious about. Processes without records never improve, because you don't know what to fix.

If I were you, I'd go this route.

I've been dealing with this for a long time. The harder it is to reverse a decision, the slower you should make it.

I'm also curious if anyone does it differently.