Ransomware at Your Company: How to Protect Yourself and What to Do If It Hits

Monday morning. The accountant opens 1C — “file is corrupted.” On the desktop there’s a text file: your data has been encrypted, transfer such-and-such an amount in cryptocurrency. That’s ransomware, and we get these calls in Tashkent regularly. Here’s how it gets in, how to protect yourself at a reasonable cost, and what to do if it’s already too late.

How infections really happen

Not “hackers broke in.” In the vast majority of cases, an employee opens the door:

• An email attachment — “Invoice for payment,” “Reconciliation statement,” “Resume” — containing a document with a macro, or an archive with an executable file. Accounting is target number one, because it opens dozens of these files every day.
• Remote Desktop (RDP) exposed to the internet with a simple password. Bots try passwords around the clock; “Admin123” is cracked in minutes.
• Old vulnerabilities — a server that hasn’t been updated since 2019, a router with the factory password.
• A USB stick from a home computer, a Windows “activator” downloaded by an employee.

From there, the malware encrypts everything the employee’s account can reach: local drives, network folders, connected external drives holding the “backup.” If the employee has administrator rights — the entire server.

What actually protects you

Antivirus is necessary, but it stops fewer than half of modern ransomware strains: they use legitimate Windows tools. What works is a combination of measures, each closing off its own path:

1. User permissions. Employees work without administrator rights. Malware launched by a regular user can’t disable protection or reach the server. This is free and delivers the most.
2. Isolated backups. Copies that can’t be seen from workstations: a separate server with separate passwords, off-site copies, snapshots that can’t be deleted. If you’re infected, you restore in hours instead of negotiating with extortionists.
3. A closed perimeter. No RDP exposed to the internet — only via VPN. A router with up-to-date firmware and changed passwords.
4. Updates. Windows, servers, routers, 1C — on a schedule, not “someday.”
5. Two-factor authentication for email, VPN and cloud services. A stolen password stops being a key.
6. Employee training. Half an hour once a quarter, plus simulated phishing emails. After two or three rounds, the share of people who open the “supplier invoice” drops several times over.

If it’s already happened: the first hours

1. Disconnect the infected computer from the network — pull the cable, turn off Wi-Fi. Don’t shut the computer down: encryption keys may still be in its memory.
2. Disconnect the server and network storage until the scope is clear. An hour of downtime is better than an encrypted server.
3. Don’t pay. Statistically, a quarter of those who pay never get a working key, and half get infected again — you’re now on the list of “payers.”
4. Call your IT provider before anyone starts “cleaning” with antivirus: traces of the infection are needed to understand where it came from.
5. Identify the entry point: whose email, whose computer, whether RDP was exposed. Until it’s closed, restoring is pointless.
6. Restore from backup onto a clean system. If there’s no backup, check whether this ransomware variant can be decrypted for free (public decryptors exist for older versions).
7. Change all passwords, including email and online banking: ransomware often steals data first and encrypts it afterward.

What it costs

For a company with 20–30 workstations, the six measures above amount to a few days of engineering work plus a backup server in a data center. This is included in our Standard plan or can be arranged as a standalone information security service. Recovering from an infection without backups means weeks of downtime and, often, years of lost data. The comparison speaks for itself.