RemoteRansomware
Ransomware: how it gets in, what to do in the first hour, and how to come back.
Ransomware locks your files and often steals a copy first. Backups get you running again, but they do not undo the theft or remove the attacker. Here is how attacks start, what to do the moment you see a ransom note, the Australian reporting rules, and how to recover without letting them back in.
Response guidance from ASD and CISA. Payment reporting rules from the Department of Home Affairs.
- First-hour actions
- Reporting rules
- Ten-point readiness check
Reviewed by Blake Bath, General Manager, on 30 October 2026.
The way in
How ransomware gets into a business.
In Sophos's 2026 global survey of 2,158 victims, the reported root causes were spread across a few doors.
Email and phishing
Malicious email was named in 26% of incidents and phishing in 24%.
- Attachments
- Fake sign-in pages
- Filtering and training
Stolen logins
Compromised credentials were named in 23%.
- Reused passwords
- No MFA on remote access
- Old accounts
Unpatched systems
Exploited vulnerabilities were named in 18%.
- Firewalls and VPNs
- Exposed apps
- Patch fast
Remote access and suppliers
Remote desktop, management tools and vendor logins that nobody watches.
- No open RDP
- Time-limited vendor access
- Monitored tools
Ransomware readiness check
Could you recover from ransomware next week?
Tick what is true today. The gaps are where an attack would hurt most.
Tick what is true at your business today. What is left is where ransomware would hurt most.
Where you stand
0of 10 controls in place
10 gaps to close.
- A backup copy attackers cannot deleteAttackers go after backups before they encrypt.
- A restore tested this quarterA green backup report is not proof you can restart.
- MFA on email, remote access and adminStolen logins are a leading way in.
- No remote desktop open to the internetExposed remote access is a common entry point.
- Internet-facing systems patched quicklyExploited flaws were 18% of root causes in the Sophos survey.
- No everyday admin rightsLimits how far one stolen login can reach.
- Endpoint detection, watched out of hoursAttacks do not wait for business hours.
- A printed incident planThe first hour decides how bad it gets.
- Insurer and responder details knownSome policies require their approved responders.
- Supplier remote access reviewedA supplier's access is your access.
If it happens
What to do in the first hour.
- IsolateUnplug affected computers from the network and turn off Wi-Fi. If you cannot isolate them, shutting down stops the spread but loses evidence in memory. Follow your responder.
- Call for helpYour IT provider or incident responder, then the Australian Cyber Security Hotline on 1300 292 371. Use phones, not company email.
- Protect the backupsDisconnect backup systems from the network until a responder says they are clean.
- Write it downPhotograph ransom notes. Note times, systems and every action taken.
- Tell your insurerEarly, through the claims line. Use their approved responders if your policy requires it.
- Do not wipe or rebuild yetRestoring before you know how they got in lets them straight back in.
The hard question
Should you pay? And what you must report if you do.
ASD advises against paying. Payment does not guarantee your files come back, and it does not stop stolen data being published. Get legal advice before any decision.
If your business turns over more than A$3 million a year and pays a ransom, or someone pays on its behalf, you must report the payment to ASD within 72 hours. This has applied since 30 May 2025. A demand you do not pay does not trigger this rule.
If personal information may have been taken, the Notifiable Data Breaches scheme can apply too. You must take reasonable steps to assess a suspected breach within 30 days, and notify the OAIC and the people affected as soon as practicable once you know it is an eligible breach.
Coming back
Recover without letting them back in.
- Find the way in firstHow they got in, which accounts they used, and what they took. Close it before restoring.
- Pick a clean recovery pointCheck it against the timeline of the attack, and test it somewhere isolated.
- Rebuild, do not just restore filesAttackers leave scheduled tasks and accounts behind. Rebuild affected systems from trusted images.
- Reset accessSign out all sessions, remove unknown app permissions, and change passwords in a planned order.
- Watch closelyHeightened monitoring for weeks after, in case the attackers try to return.
Our view
Backups decide whether it is a bad week or the end of the business.
In Sophos's survey, data was encrypted in 56% of attacks, and two-thirds of those victims used backups to recover. To be in that group you need a backup copy the attacker cannot reach, and a restore someone has actually tried.
So start there: a protected backup copy with separate logins, a restore tested on a schedule, MFA everywhere, no exposed remote desktop, and someone watching endpoint alerts out of hours.
Prevention
Five layers that stop most ransomware.
- Step 1Protected backups
A copy attackers cannot delete, tested.
- Step 2Strong sign-in
MFA everywhere, phishing-resistant for admins.
- Step 3Fast patching
Internet-facing systems first.
- Step 4Least privilege
No everyday admin rights.
- Step 5Watched endpoints
Detection and response, out of hours too.
Related guides
Ransomware is the outcome. These are the controls.
Each covers one layer in more depth.
Get help your way
Six ways to reach us. Pick whichever suits you.
Helpdesk hours are Monday to Friday, 8am to 5pm AEST. On Advantage and above, emergencies get a response within 1 hour and outages within 2, with 24/7 best-effort escalation.
- Call 07 3114 2808
An engineer answers Monday to Friday, 8am to 5pm AEST. After hours, weekends and public holidays, Chip, our AI agent, answers on the same number or on 07 3180 0965, logs it and escalates urgent incidents to the on-call engineer.
Call now - Email the helpdesk
Send it to helpdesk@realbytes.com.au and a ticket is logged straight away, with a reference number you can quote.
Email us - Client portal
Log and follow your tickets, see what we are working on and who has it.
Open the portal - Remote support
When an engineer asks to see your screen, start a secure session here. You start it, so nobody sees your screen until you do.
Start a session - Chat in Microsoft Teams
Clients can message Chip, our AI assistant, in Teams to log a request without leaving their desk.
How clients reach us - Service status
Check whether Microsoft 365 or another cloud service is down before you lose an hour troubleshooting.
See live status
Questions
What people ask about ransomware.
Should we pay a ransomware demand?
ASD advises against paying because payment does not guarantee recovery or prevent stolen data from being disclosed. Contain the incident, contact your response provider and insurer, and seek legal advice. The Australian Cyber Security Hotline is 1300 292 371.
Do working backups solve a ransomware incident?
Working backups help restore systems but do not undo data theft or remove attacker access. Validate the recovery point, close the entry route and check for persistence before reconnecting restored systems. Assess exposed personal information separately from availability recovery.
Should I turn off a computer affected by ransomware?
Isolate it promptly and follow the incident response plan. CISA business guidance prioritises disconnecting hosts or network segments, with shutdown if isolation is not possible because shutdown loses volatile evidence. ASD public guidance also recommends shutdown to stop spread. A responder should direct the choice in a managed business environment.
When must an Australian business report a ransomware payment?
A captured entity must report within 72 hours of paying or becoming aware of a payment made on its behalf. The regime commenced on 30 May 2025 and uses an AUD 3 million turnover threshold, with specific critical-infrastructure and part-year-business rules. A demand without payment does not trigger this payment-reporting duty.
Do we have 30 days to notify the OAIC?
No. The 30-day period relates to assessing a suspected eligible breach, not a general notification deadline. Covered organisations must take all reasonable steps to assess within that period and notify the OAIC and affected individuals as soon as practicable once an eligible breach is established.
What reduces ransomware risk for a small business?
Combine prompt patching, phishing-resistant authentication, restricted administrative access, monitored endpoints and protected, tested backups. Apply the Essential Eight to the relevant environment and document who responds outside business hours. No single product prevents every ransomware incident.
Next step
Under attack, or want to make sure you never are?
Call us now if it is happening. Otherwise, we will test your backups and close the most likely ways in.
Keep reading
- Payment reporting 72 hours.
- First hour Incident checklist.
- Backup and DR Our service.
- Essential Eight Baseline.
Reviewed by Blake Bath, General Manager, on 30 October 2026. Survey figures are global and self-reported, not Australian prevalence. Reporting rules from Home Affairs and the OAIC. Checked 30 October 2026. Sophos, State of Ransomware 2026; CISA, I've been hit by ransomware; ASD, Recover from ransomware; Home Affairs, Ransomware payment reporting factsheet; OAIC, The Notifiable Data Breaches scheme