Ransomware training: Page After Page

Page After Page [0:05] Mona: The same page, again and again: 'Your files are locked.' [0:13] Mona: Layla, it's Mona. The third-floor printer keeps printing a ransom note. I haven't touched it. [0:21] Layla: That's ransomware: criminals lock files, often copy them, then demand money. Which laptop sent it? Check the printer. [0:30] Mona: It came from Hana's laptop. Her desk is by the window. I'm going over. [0:37] Hana: Mine? My files wouldn't open around ten. I meant to tell someone after my calls. My fault. [0:44] Narrator: Files acting strange? Call your security team at once, from your phone, not the laptop. [0:50] Layla: Hana, unplug the network, not the power: Wi-Fi off, cable out. [0:56] Layla: Good. Offline, it can't spread from here. Leave it switched on: it keeps clues we need. [1:03] Layla: Hands off: no restart, no deleting, nothing plugged in. Take a photo of the screen with your phone. [1:12] Mona: Every page it printed. I kept them all for you. [1:17] Narrator: At ten, Hana's screen already showed three signs of ransomware. Can you spot them? [1:28] Layla: Files that suddenly won't open. A strange new ending on the names. A new file on getting them back. [1:35] Layla: Any one is enough. Report it at the first sign, however busy you are. Don't wait for the note. [1:43] Hana: My client deadline is today. If we pay, do the files come back faster? [1:49] Layla: Leave the note to us: don't pay, reply or visit anything in it. Paying guarantees nothing and funds the next attack. [1:58] Mona: How did it even get in? [2:01] Layla: Usually email, stolen passwords or out-of-date software. Attackers often wait days, then strike when people are busy or away. [2:11] Layla: The shared drive's back from last night's backup. Thanks to your fast call, we lost a morning, not the month. [2:19] Hana: At ten, it was a few files. Next time, I call first. The calls can wait. [2:26] Mona: Visitor badges again. That's the printer I know. [2:31] Narrator: One habit: at the first sign, don't wait for the note. Call your security team from your phone.