Initial Assessment and Containment
Team arrives and conducts an immediate threat assessment, identifying affected systems and isolating them to halt further spread.
Power down or disconnect compromised devices strategically, preserving evidence while preventing additional encryption.