Ransomware: how to defend and what to do when it strikes

Ransomware encrypts your data and the attacker demands a ransom for the key. The most effective way to recover is from backups that the attacker cannot reach and that you have already tried restoring. CISA, the FBI, the NSA and MS-ISAC say it plainly in their joint guide: keep backups offline and encrypted, and test regularly that you can restore from them. The rest rests on patches, MFA and a closed remote access. And when an attack comes, the first minutes decide.

The ways in are ordinary: an unpatched server, a leaked password, remote access exposed to the internet. This text shows how ransomware gets in, what to back up, what to do in the first hour and whom to report to.

How ransomware gets in

In its October 2023 guide, CISA groups protection by six entry routes: flaws and badly configured systems that the whole internet can see, compromised passwords, phishing, earlier malware, advanced social engineering, and suppliers or IT administrators.

The attack also does not start with encrypted files. Microsoft described in 2020 that ransomware often runs weeks or months after the attackers began acting in the network. During that time they steal passwords, gain higher rights, and one group, according to Microsoft, deleted local backups to make recovery harder. CISA therefore warns that ransomware can be a trace of an earlier unresolved intrusion, and advises looking for the malware that prepared it before you restore. The first step is often phishing.

How to defend

There is no single button. Several layers work one behind the other, and each catches what the previous one lets through:

• Backups. The classic 3-2-1 rule from the CISA document Data Backup Options says: 3 copies of an important file (the original and 2 backups), on 2 different types of media, 1 copy off the premises. Against ransomware CISA also wants an offline copy, and explains why: most attackers look for accessible backups and delete or encrypt them. Cloud backups alone may not be enough, because encrypted files can sync and overwrite the healthy ones.
• Restore test. A backup you have never restored is only an assumption. CISA wants regular checks that a backup can be opened and that it is complete.
• Patches. According to Microsoft, attackers use disclosed flaws in systems that nobody has fixed. CISA adds that this holds for backup software too.
• MFA on e-mail, the VPN and accounts that reach critical systems. CISA recommends resistant MFA for all services.
• No unprotected remote access from the internet. CISA: do not expose services such as remote desktop (RDP) on the web. If they must stay, add further safeguards.
• Separate accounts and network. CISA advises keeping administrator accounts apart from user accounts and splitting the network into parts, so an attack does not spread everywhere.
• A plan on paper. CISA wants the incident response plan to exist printed and offline too.

What a company of 20 does

This is our proposal based on the sources above, not a rule. For a company with one server and a few dozen computers, five steps are enough, and each can be done in an afternoon:

1. List what the company cannot leave without operation: accounting, orders, shared files, e-mail. You order backups and recovery by it.
2. Back up to two media and disconnect one copy from the network, for example a disk that connects only for the duration of the backup, or immutable storage at a provider. On immutable storage CISA adds that it should be used with caution, because it does not meet the conditions of some regulations and badly configured storage gets expensive.
3. Once a quarter, restore one important system on a test machine and measure how long it takes. Then you know the duration instead of guessing.
4. Turn on MFA for e-mail and the VPN and cancel direct remote access from the internet.
5. Write one page: who calls whom, who shuts the network down, where the contact for the IT supplier and for NÚKIB is. And print it.

Ransomware struck: the first hour

The procedure follows the CISA checklist. Steps one to three go in sequence.

1. Isolate. Find out which systems are hit and disconnect them. If several machines or subnets are hit, shut the network down at the switch. Attackers may watch whether you have detected them, so call by phone, not by e-mail inside the hit network.
2. Do not switch machines off right away. Disconnect them from the network and leave them on. CISA advises switching a machine off only when it cannot be disconnected, because switching off loses evidence kept in memory. No More Ransom advises the same: disconnect, do not switch off.
3. Set the order of recovery. First what the company earns money with, from the list you prepared.
4. Look for the cause. Go through the logs and look for earlier malware. If you restore from a backup into a network that is still compromised, the attacker returns.
5. Find out whether a tool that unlocks the data exists. For some variants it is free at nomoreransom.org.
6. Restore from offline backups. First make sure the backup contains no malware, reinstall the machines and only then connect them.

Then comes the reporting. If your service falls under Act No. 264/2025 Coll., you send NÚKIB a initial report without undue delay, within 24 hours of detecting the incident at the latest, through the Office's portal. For an incident with a significant impact, a notification is due within 72 hours and a final report within 30 days of it. Companies in the lower regime report to the National CERT only incidents with a significant impact. More about whom the act covers is in the article on NIS2 and the new act.

If the attack touched personal data, report it to the Office for Personal Data Protection (ÚOOÚ), where possible within 72 hours of the moment you learned of it. You have to tell the people whose data leaked when there is a high risk to their rights and freedoms. No More Ransom advises reporting the attack to the police too.

To pay or not

CISA, the FBI, the NSA and MS-ISAC do not recommend paying the ransom. According to the guide, payment does not guarantee that you will decrypt the data, that the attacker will vanish from the network or that the data will not be published. No More Ransom, a project of Europol and partners, writes: the general advice is not to pay. The management of the company decides on payment, but we do not recommend it.

Mistakes that keep repeating

• A backup on the same disk or in the same network. Ransomware finds it and encrypts it.
• A backup without a restore test. You find out only when you need it.
• Switching everything off at once. The traces in memory that show how the attacker got in are lost.
• Recovery without looking for the cause. The same vulnerability stays open.
• A plan that sits on the server. When the server is down, nobody can read it.

Sources

• CISA, FBI, NSA, MS-ISAC, #StopRansomware Guide, October 2023: https://www.cisa.gov/sites/default/files/2025-03/StopRansomware-Guide%20508.pdf
• CISA, Data Backup Options (Ruggiero and Heckathorn): https://www.cisa.gov/sites/default/files/publications/data_backup_options.pdf
• Microsoft Threat Intelligence, Human-operated ransomware attacks: A preventable disaster, 5 Mar 2020: https://www.microsoft.com/en-us/security/blog/2020/03/05/human-operated-ransomware-attacks-a-preventable-disaster/
• No More Ransom, Prevention advice for businesses, viewed 25 Oct 2026: https://www.nomoreransom.org/en/prevention-advice-for-businesses.html
• Act No. 264/2025 Coll., sections 15 and 16, effective 1 Nov 2025: https://www.zakonyprolidi.cz/cs/2025-264
• ÚOOÚ, Porušení zabezpečení osobních údajů (personal data breach), viewed 25 Oct 2026: https://uoou.gov.cz/profesional/poruseni-zabezpeceni-osobnich-udaju