SESKStuff Everyone Should Know
SESK: Stuff Everyone Should Know · sesk.info/aero-ransomware-power-down

If an infected computer cannot be unplugged from the network, what does CISA say to do?

Power the device down so the ransomware cannot spread.

Start playing free

  1. Restart it over and over
  2. Leave it on and wait
  3. Power the device down ✔

Why: The goal is to stop the infection from jumping to other machines. Cutting the network connection is best. If that is not possible, turning the device off stops it from spreading the ransomware further.

Huh, didn't know that: CISA treats powering down as a fallback when neither host isolation nor a temporary network shutdown is possible.

The dad joke
Why did the computer take a nap during the attack? Doctor's orders: power down.
Like this card?
Play the game

References

Answer: Power the device down. The goal is to stop the infection from jumping to other machines. Cutting the network connection is best. If that is not possible, turning the device off stops it from spreading the ransomware further.

  1. CISA #StopRansomware Guide www.cisa.gov/stopransomware/ransomware-guide
    Power down devices if you are unable to disconnect them from the network to avoid further spread of the ransomware infection.
    Checked 2026-10-10.

Think this answer is wrong? Tap "Challenge this answer" on the card in the game and tell us why.

Test yourself in the game

Flying & DronesDuring a ransomware attack, what should defenders do first with the infected computers?Flying & DronesAfter a ransomware attack, where should a company restore its data from?Flying & DronesWhat does ransomware typically do?

That's stuff everyone should know.