You are in the right place. We respond 24x7.

Our DFIR team responds around the clock. Pick the channel that matches your urgency — then follow the steps below while you wait.

Critical Call now +47 94 10 20 30 We need to get in contact immediately Urgent Chat now Telegram · Signal We'd prefer a rapid answer Important Email us dfir@improbus.com Can wait until tomorrow

Do

  1. Isolate, but keep it running.
    Cut the network, not the power. Pull the cable, disable Wi-Fi, or isolate the cloud resource (security group / NSG). RAM and live sessions hold key evidence — including ransomware keys.
  2. Preserve evidence as-is.
    Capture before it expires. Logs, screenshots, ransom notes, alerts. In cloud, snapshot disks and export logs now — they rotate and age out fast.
  3. Secure your backups.
    Confirm offline or immutable. Disconnect them from the affected environment. Verify, but do not restore yet — they may be compromised or trigger on contact.
  4. Communicate out-of-band.
    Assume email and chat are read. Coordinate by phone or a known-clean device until we say otherwise.
  5. Log a timestamped timeline.
    Who saw what, when, and every action since. Name one incident lead. Contemporaneous notes carry evidentiary weight.

Don't

  1. Don't power off or reboot.
    Shutdown, sleep, and restart wipe memory. Volatile evidence and live keys are lost. If hardware must move, snapshot first.
  2. Don't clean, reimage, or restore.
    AV scans, removal tools and rebuilds destroy evidence and rarely evict a determined attacker. Leave remediation to the response plan.
  3. Don't change credentials yet.
    Mistimed resets tip off the attacker. Never reset from a suspect system. Wait for safe sequencing across identity, cloud and endpoints.
  4. Don't pay or contact the attacker.
    No recovery guarantee — and real risk. It funds crime and may breach sanctions law or your insurance. Speak to us and law enforcement first.
  5. Don't go public or admit liability.
    Disclosure has legal consequences. Mind the 72-hour breach-notification clock — we'll guide regulator, insurer and police notices.

Hover or tap an item to see why.