The first 30 minutes: three moves, in order
One: unplug the network cable. Pull the cable out physically. Do not just disable the network adapter from the operating system. Ransomware moves sideways across a LAN through shared folders, domain credentials and weak passwords, and while one machine is being encrypted your NAS, file server and other desktops may be next in line. Cutting the cable is a tourniquet.
Two: do not shut down, and do not reboot. The instinct for many customers is to restart and see whether it comes back. Two problems with that. Part of the encryption key may still sit in memory, and a shutdown destroys it along with any chance of analysis. Worse, a boot-level infection can leave the machine unable to start at all, which takes the evidence with it. Leave it running and photograph the ransom screen.
Three: map the damage. Which machines are hit? Is the shared drive still reachable? When did the last backup run, and where does it live? Those three answers decide which road you take next.
The 2026 market: fewer people paying, for good reason
Some public numbers from this year make the picture clearer:
- In the first half of 2026 there were about 6,256 verified ransomware victims worldwide, up roughly 45% year on year, yet the share of victims who chose to pay fell to 28%, the lowest on record.
- Among the families active in China, Weaxor, Wmansvcs and Sorry account for most of the incidents. A Qihoo 360 count in May produced one striking figure: 58.94% of affected devices had no security software at all, and another 20% or so had software installed with protection turned off.
- The entry point is shifting too. Around 79% of ransomware attacks this year started from stolen account credentials rather than a software vulnerability. Remote Desktop on port 3389 with a weak password, an aging OA or ERP system, and VPN appliances nobody administers are the most common doors.
- There is also the wiper, which erases files whether or not you pay. Buying your data back was never an honest transaction to begin with.
The industry consensus is clear: paying is not a recovery plan; backup is. Cases of companies paying and getting no working decryptor turn up every year, and the record-low payment rate shows that the live-on-backup approach does work.
Case: a Nansha metal stamping shop, restored from backup in six hours
At 7:00 a.m. on July 14, 2026, the accountant at a metal stamping factory in Nansha found that the finance office PC could not open drawings from the shared drive. A README file had appeared on the desktop, and every CAD drawing and ERP database file had a strange new extension. At around 2:00 that morning the infection had walked in through an old office machine running Remote Desktop with the password admin888, scanned sideways to the file server, and encrypted most of the shared directory.
Our sequence:
- Isolate and check. All 12 PCs on site were disconnected one at a time. Three were infected, the file server's shared directory was encrypted, and the ERP database on SQL Server had lost only its backup files because of how the service account permissions were set. The main database files survived. That was luck, not design.
- Sample analysis. We submitted the ransom screen and an encrypted sample for comparison against the decryptor libraries for known families. The verdict: a Weaxor variant with no public decryptor, and brute force was not realistic against double encryption.
- Backup assessment. The factory had a Synology DS220+ backing up key directories from the file server at 10:00 every night. The job had stopped three months earlier when the volume filled up, and the last successful run was April 9. Three months of drawings would have to be redrawn.
- Recovery. The file server was wiped and reinstalled and its base data restored from the April backup. About 70% of the April-to-July drawings were pieced back together from engineers' local working copies and email attachments. We mounted and restored the ERP master database directly. The plant was running again by 1:00 p.m., and the direct loss was the labor to redraw three months of drawings.
- Closing the door. The 3389 mapping from the internet was removed network-wide and replaced with VPN plus two-factor authentication. Every machine password was reset to 12 characters or more with no reuse. The NAS backup job was repaired with a WeChat notification on completion, and a capacity alarm was added to the disks.
The factory director put it plainly: If you knew the disk was full and nobody was watching, there was no backup.. That sentence belongs on the wall of every small company. An unverified backup is a guess.
Can you decrypt without paying?
Sometimes, but it depends on the family and on luck. Here are the channels, ranked by how often they work:
- No More Ransom at nomoreransom.org, run jointly by Interpol, Europol, Kaspersky and others, offers free decryptors for hundreds of families. After a hit, upload the ransom note and a sample file, ideally an encrypted and pre-encryption pair, to their Crypto Sheriff service to identify the family.
- Tools from security vendors. Qihoo 360, Huorong and Tencent PC Manager all maintain ransomware search and decryption libraries in China, and several families including Wmansvcs already have dedicated decryption services.
- Stock tools for older families. For WannaCry, GandCrab and similar older malware the decryptors are mature. Most of the families newly active in 2026 are not covered.
If the family cannot be identified and no decryptor exists, two options remain: restore from backup, or pay. We do not recommend paying, for the reason above. The flip side of that 28% payment rate is that more than 70% of companies chose not to pay, and the sky did not fall.
Making 3-2-1 work in a small company, in plain English
The 3-2-1 rule means 3 copies of the data, on 2 kinds of media, with 1 copy off site. Translated into something an SME can actually buy:
| Layer | What you do | Reference cost |
|---|---|---|
| Copy 1, online | The file server or NAS itself, on RAID 1 or RAID 5 | Already in place |
| Copy 2, local and offline | A scheduled NAS job writing to a USB hard drive that someone unplugs once a week | One 4TB portable drive, about RMB 700 |
| Copy 3, off site | Key directories synced to enterprise cloud storage or object storage, out of ransomware's reach | Around RMB 300-600 a year for the 100GB class |
| Verification | Pull one file out of the backup every month and open it | Free, 10 minutes |
However tight the budget, do at least one of copy 2 and copy 3. If cloud backup had been running at the factory above, the loss would have been zero instead of three months of drawings.
Who to call
Businesses in Panyu and Nansha can call 020-39029800 at any hour. What we provide is not decryption, which nobody can guarantee, but the whole sequence around it: isolation to stop the bleeding, family identification, backup assessment and recovery, and an entry-point audit with hardening. Scenarios we have handled include an encrypted OA system, an encrypted file server share, an encrypted SQL database and a single infected workstation.
One last reminder. Having antivirus installed does not mean you are protected. About 20% of the devices hit this year had security software on them with protection switched off. After installation, check that the icon in the corner is green.