First 30 minutes: three things to do in order
Item 1: Unplug the network cable.Physical unplugging is not "disabling network connections." Ransomware spreads horizontally in the local area network by sharing directories, domain control credentials and weak passwords. A machine is attacked, NAS, file servers, and other computers may be encrypted. Unplugging the network cable is hemostatic.
Number two: don't shut down, don't restart.The first reaction of many customers is to restart "try to be good". Two problems: one is that part of the virus encryption key is still in memory, shutdown is really gone (adverse to subsequent analysis); the second is that the boot virus may not directly enter the system after restart, even the evaluation site cannot be done. Let it open, and the blackmail information page on the screen will be photographed.
Item 3: Scope of inventory.Which machines are hit? Can the shared disk still be accessed? When was the last backup and where is the backup? These three pieces of information determine which way to go next.
II. Market in 2026: Fewer and fewer people pay for a reason
Here are a few public figures for this year to help you see the situation:
- In the first half of 2026, there were about 6256 verified extortion victims worldwide, up about 45% year-on-year, but the proportion choosing to pay ransom fell to28%It is the lowest point in history.
- Among the active families in China, Weaxor, Wmansvcs and Sorry account for most of them.360 In May this year's statistics, there is an eye-catching number:58.94% of the affected devices are not equipped with any security softwareAbout 20% of them are installed but not protected.
- Attack portals are also changing: about 79% of extortion attacks this year startedStolen account passwords, rather than system vulnerabilities. Weak password remote desktops (3389), old OA and ERP, and unattended VPN devices are the most common doors.
- There's also a new threat called erasers--files are erased regardless of whether you pay for them. Paying for data is inherently dishonest.
The industry consensus is clear:Paying is not a recovery plan, backups are.There are cases every year when you pay for a decryption device, and the record low payment rate just shows that "living on backup" works.
III. Case: A hardware processing factory in Nansha took 6 hours to recover from backup
At 7:00 a.m. on July 14, 2026, the accountant of a hardware stamping factory in Nansha found that the computer in the finance office could not open the drawings in the shared disk. There was an additional README file on the desktop. All CAD drawings and ERP database file suffixes became strange characters. At 2:00 a.m. the night before, the virus came in from an old office computer with a remote desktop and password of "admin888". It scanned horizontally to the file server and encrypted most of the shared directory.
Our processing order:
- grid isolation: 12 computers in the whole plant were disconnected one by one and checked. It was confirmed that 3 computers were recruited. The file server shared directory was encrypted. The ERP database (SQL Server) only encrypted the backup files due to the service account permission setting. The main database files survived. This is luck, not design.
- Extraction sample analysis: Send the blackmail information page and encrypted samples to the decryption tool library of known families. The conclusion is Weaxor variant, no public decryptor, brute force cracking is not realistic (double encryption).
- Evaluate backup: There is a Synology DS220 + in the factory, which automatically backs up the key directories of the file server at 10:00 every night--but the backup task stopped three months ago because the disk was full, and the last successful backup was9 April. Three months of drawings to redraw.
- recover: File server was formatted and reinstalled, and basic data was restored from April backup; about 70% of incremental drawings from April to July were pieced together by working copies and mail exchanges of engineers 'local computers;ERP master database was directly mounted and restored. The whole plant resumed production at 1:00 p.m., and the direct loss was three months of drawing redrawing man-hours.
- Block the entrance.: Close the 3389 external network mapping of the whole network, change VPN access + two-factor authentication; reset the password of all machines to more than 12 digits without repetition; repair NAS backup tasks and add "WeChat notification after backup completion", and add capacity alarm to disks.
The factory director finally said something real: "I knew that the backup disk was full and no one was in charge, which meant that there was no backup." This sentence is worth copying on the wall by all SMEs:An unverified backup is just a guess.
Four, is it possible to decrypt without paying?
It's possible, but it depends on luck and family. Several channels are ranked according to reliability:
- No More Ransom Plan(nomoreransom.org): Interpol, Europol, Kaspersky and others jointly maintain free decryptors for hundreds of families. After being hit, upload the blackmail information page and sample files (encrypted + pre-encrypted best) to their Crypto Sheriff identification family.
- Free tools from security vendors: Domestic 360, tinder, Tencent computer housekeeper have ransomware search/decryption tool library, Wmansvcs and other parts of the family has dedicated decryption services.
- Old family stock tools: If it is an old virus such as WannaCry and GandCrab, the decryption tool is very mature. However, most of the new active families in 2026 do not.
Without recognition and decryption, there are only two options left: restore from backup, or pay. We don't recommend paying, for the reasons mentioned above--the payment rate of 28 percent--the flip side of this number is that more than 70 percent of companies choose not to pay, and the sky doesn't fall.
V. How to land 3-2-1 backup for small and medium-sized enterprises (spoken version)
3-2-1 Principles: 3 data, 2 media, 1 offsite. Translated into practical solutions for SMEs:
| level | practices | reference cost |
|---|---|---|
| Copy 1 (online) | File server/NAS itself, RAID1 or RAID5 | existing |
| 2nd copy (local offline) | NAS scheduled backup tasks →USB removable hard drive, manually unplug once a week | One 4TB mobile hard drive is about RMB 700 |
| 3rd (off-site) | Critical directory synchronization cloud (enterprise network disk/OSS), ransomware out of reach | 100GB class about RMB 300–600/year |
| verification | Pull one file a month and restore it from backup. Open it. | $0 for 10 minutes |
No matter how tight the budget is, at least one of the 2nd and 3rd drawings will be made. If the cloud backup is running in the factory above, the loss will be zero instead of three months of drawings.
6. Who to look for
Enterprises in Guangzhou Panyu and Nansha can call 020-39029800(24 hours) directly. What we provide is not "decryption"(no one can guarantee), but: isolation stop loss, family identification, backup evaluation and recovery, entry inspection and reinforcement. The scenarios processed include OA being encrypted, file server shared directory being encrypted, SQL database being encrypted, and single server being attacked.
One final reminder:Installing antivirus software doesn't mean you're protected.--About 20% of the equipment recruited this year has installed security software, but the protection is not turned on. Remember to check whether the icon in the lower right corner is green after installation.