Suspected ransomware or unusual encryption activity

Treat this as a P1 and call +91 011-41051450 in addition to raising a ticket.

Immediate steps:
1. Isolate affected hosts from the network — do not power them off, memory evidence matters.
2. Disable the affected user accounts and rotate privileged credentials.
3. Do NOT delete anything, and do not restore over your only clean copy.
4. Verify your immutable/air-gapped backup copy is intact and take it offline.
5. Preserve logs from the firewall, EDR and domain controllers.

Our team will join and drive containment, forensics and staged recovery.