We received a ransomware warning for our server, what should we prep before it hits us?

Moving your RDP port from 3389 to another random port does not provide real security; it only buys you a few hours against automated bots. The actual fix: completely close RDP to the public internet, restrict access strictly behind an IP-whitelisted VPN, and enforce MFA. Even this single step drastically reduces your attack surface.

Backing up to a NAS on the same local network is practically the same as having no backups at all. Once ransomware breaches a server, it scans the entire subnet, maps Windows network shares, and deletes or encrypts those backup files first. Your backup repository must have zero direct connectivity to your production network.

Last year, attackers breached one of our warehouse client's servers via RDP in this exact same way. They started at 02:00 AM, and by the time accounting showed up in the morning, the entire invoicing database had a '.locked' extension. They wiped the client's past year of backups on the NAS too. The company couldn't ship a single order for 4 straight days racking up hundreds of thousands of riyals in losses.

Do this today, right now: Take a full system image and database backup onto an external USB hard drive, then unplug it, lock it in a safe, and leave it on a shelf. If your system gets hit tonight, that drive is your only real guarantee of recovering with at most one day of lost data.

if you got an alert they already found the open port and are brute forcing it rn... like change all admin passwords to complex 16+ char ones immediately and rename the default 'administrator' account.

note: I wrote this based on my own experience, it might not apply to everyone.

From an organizational standpoint, you must establish an internal Incident Response Plan. Document clearly in advance which staff members are authorized to act, how to pull the plug on external internet links, and what the step-by-step data recovery protocol looks like during a suspected breach.

Don't make the mistake of feeling safe just because you have an antivirus installed. Modern ransomware payloads only execute after attackers gain elevated privileges and quietly kill the antivirus services. Security software is a shield, but no shield helps if you leave the front door wide open.

There's a part I don't understand. Hasty decisions become decisions you have to fix six months later.

I'm also curious if anyone does it differently.

Thanks, this was very helpful. The harder it is to reverse a decision, the slower you should make it.

That's all, sorry if I went on too long.

The cheap-looking path usually ends up costing more later. Hasty decisions become decisions you have to fix six months later.

Good luck with that.

Same here. Any unwritten clause becomes a point of disagreement later, as both sides remember it differently.

We need to take it step by step. An untested backup is not a backup.

This is my opinion, I'm not claiming it's absolute truth.

Quick summary for newcomers: The biggest time-waster for us was not knowing who had the final say.

Good luck with that.

im crious too.

Thanks a lot, I'll try it today.

Thanks, this was very helpful.

Let me share my experience. Your time to detect an issue directly determines its cost.

To get into the details: Trying to do this alone is the most expensive way.