Ransomware Warning Signs: Disconnect and Call Zerolimit
Ransomware Warning Signs: Disconnect and Call Zerolimit
Ransomware can encrypt files or systems, block access, and display a demand for payment. Some attackers also steal information and threaten to publish it. Warning signs include a ransom note, suddenly unreadable or renamed files, unusual file extensions, widespread error messages, a desktop background you did not set, security tools being disabled, or multiple shared files changing at once. A single alarming pop-up is not proof of ransomware, but it still deserves immediate reporting.
If you see active ransomware or rapid file changes
- Stop working immediately. Do not keep opening files, saving documents, or browsing shared folders.
- Disconnect the affected device from networks if you can do so simply and safely. Unplug the Ethernet cable and turn off Wi-Fi. Disconnect attached external drives. Do not browse through network settings or experiment if you are unsure, call Zerolimit for live direction.
- Leave the device powered on unless Zerolimit instructs otherwise. Do not reboot, shut down, wipe, restore, or factory-reset it. CISA’s ransomware response guidance prioritizes isolating impacted systems; preserving their state can also support a coordinated response.[1]
- Call Zerolimit immediately from another device. Do not use a possibly affected computer to send the report. Give your name, device location, what is on the screen, and when symptoms began.
- Warn nearby users verbally not to use the affected device or shared resource. Do not send a broad alert on your own; Zerolimit will coordinate communications.
If disconnecting would create a physical safety issue or interrupt a safety-critical system, do not do it. Move away from the workstation and call Zerolimit and the responsible site leader.
What not to do
Do not pay, negotiate, call a number in the ransom note, or contact an email address supplied by the attacker. Do not enter payment information. Do not download a “decryptor,” antivirus utility, or recovery tool from a search result. Do not plug in backup drives or copy files to removable media, because that may expose additional data.
Do not take exploratory actions such as opening more encrypted files, testing other computers, scanning the network, searching for attacker files, or deleting suspicious programs. Do not photograph or share sensitive screens publicly. If it is safe, a single photo of the screen taken with a separate device may help Zerolimit, but reporting comes first and you should not interact with the ransom note to obtain it.
Microsoft explains that ransomware is malicious software used to deny access to data or systems, commonly through encryption, and may be paired with extortion.[2] CISA’s StopRansomware guidance recommends coordinated containment, evidence preservation, scoping, and recovery rather than improvised end-user cleanup.[1]
If only one file or message looks suspicious
Do not assume the incident is harmless. Stop opening related files and contact Zerolimit. Tell them whether the file came from email, a download, a shared drive, a USB device, or a website. If you opened an attachment or enabled macros, say so. Leave the original message or file in place and do not forward it.
If a pop-up claims “your files are encrypted” but your files still work, treat it as a possible malicious pop-up: do not click its buttons or call its number. Disconnect only if you observe system or file activity suggesting an active compromise, or if Zerolimit directs you to.
What Zerolimit needs
Report the device name or asset label, physical location, username, approximate start time, exact symptoms, and whether shared drives or external devices were connected. Mention any recent attachment, link, software install, unusual login, or security warning. Identify other devices showing similar symptoms without personally checking them.
Zerolimit will coordinate isolation, investigation, internal leadership, recovery, and any required external reporting. The FTC advises businesses to contact law enforcement and appropriate incident-response partners after a data-security breach; those decisions belong to authorized leadership, not an individual end user.[3]
After the immediate response
Return to work only when Zerolimit confirms the device and affected services are safe. Do not reconnect cables, Wi-Fi, drives, or backups on your own. A restored screen does not prove the threat is gone. Follow instructions for password changes and watch for follow-up phishing that refers to the incident.