Ransomware is running. Do you pull the plug or pull the network cable?

Pull the network cable. Disconnect affected machines from the network, at the switch if several are involved, and leave them powered on. Power off only if disconnecting isn't possible in the time you have. CISA's own checklist says the same: isolate first, and treat powering down as the fallback, because it destroys volatile evidence like memory, which is often where the answer to "how did this happen" lives (Cybersecurity and Infrastructure Security Agency, n.d.). The one exception is a machine actively encrypting files you can't otherwise protect, where stopping the damage outweighs the evidence.

Why disconnecting beats powering off

Ransomware today is rarely a single machine. By the time files are being encrypted, the attacker has usually been inside for days, has credentials, and is using the network to spread. Disconnecting stops the spread and stops command-and-control, which is the point. Powering off stops that one machine and loses everything in its memory: running processes, network connections, decryption keys that some strains hold in RAM, and the traces of the tools the attacker used. Forensic guidance from NIST has made this point for years: volatile data has to be collected before it's lost, and the order of collection should run from most volatile to least (Kent et al., 2006).

There's a practical reason too. Some ransomware is designed to finish the job on reboot, or to wipe its own traces. Rebooting a machine mid-attack can make things worse, not better. Leave it on, leave it isolated, and let the people doing the investigation decide when it comes down.

How to isolate, in order

1. At the switch or firewall, if the affected machines share a segment. Shut the ports or the VLAN. This is faster and cleaner than running between desks.
2. At the machine, if it's one or two systems. Unplug the cable, turn off Wi-Fi. Don't log out, don't close windows.
3. In the cloud, snapshot the affected volumes before changing anything, then isolate the instance with security groups or the provider's equivalent (Cybersecurity and Infrastructure Security Agency, n.d.).
4. Out of band. Coordinate on phones, not on the corporate chat the attacker may be reading. CISA calls this out specifically, because attackers who learn they've been spotted often accelerate.

What to protect while you're isolating

Backups. If your backup server or your backup credentials are reachable from the affected network, that's the thing to protect before anything else. Attackers target backups deliberately, because a company with working backups doesn't need to pay. The UK's National Cyber Security Centre lists offline, disconnected backups as the primary defence against ransomware for this reason (National Cyber Security Centre, 2021). If you have one offline copy, physically confirm it's still offline.

Domain controllers and identity systems come next. If the attacker has domain admin, the encryption is the end of the attack, not the start. Containing the identity layer is what stops a second wave.

What not to do

Don't wipe and rebuild yet. That's eradication, and it comes after you know the scope. Don't restore from backup onto a network the attacker still has access to. Don't communicate with the attacker from the affected environment. And don't let anyone "just check" the infected machine by logging in with a privileged account; that hands over another credential.

Who should be able to do this

Pulling a switch port at 2 a.m. is a decision someone has to be allowed to make without a meeting. If your network team needs change-control approval to isolate a segment, the plan needs an emergency exception written into it, with the names of the people who can invoke it. NIST's current guidance treats this kind of pre-authorisation as part of preparation, not something to improvise (Nelson et al., 2025).

What I'd do next

Check two things this week: can someone isolate a network segment in under five minutes, and is your backup really unreachable from the production network? If either answer is no, that's where I'd start. If you'd like help pressure-testing your containment plan against a realistic scenario, request a briefing. More on the executive side of a live incident is in Incident Response: What Executives Need to Know.