Recommended Free Tools
If you suspect a nation-state intrusion, activate your incident-response plan, coordinate a controlled containment decision, preserve evidence, and investigate beyond the first alert. Bring security, IT, leadership, legal, communications, and business continuity into the response, and contact qualified incident responders and appropriate authorities. Do not wipe or rebuild affected systems until responders have considered what evidence needs to be preserved.
What to do first during a suspected nation-state intrusion
Treat a credible alert as a potential incident, not as proof of the attacker’s identity or the full extent of access. The immediate goals are to limit further harm, retain evidence that can establish what happened, and keep essential operations safe.
As an Amazon Associate I earn from qualifying purchases.
- Activate the incident-response plan. Assign an incident lead and use the organization’s established decision process. If no formal plan exists, designate a lead and record who is authorized to approve containment and service interruptions.
- Decide how to contain affected systems. Work with incident responders and system owners to isolate systems in a controlled way. The right action depends on the system, evidence, operational impact, and risk of continued access; do not assume every device should be disconnected or shut down.
- Preserve evidence before making destructive changes. Ask responders to assess whether logs, artifacts, system memory, and forensic images should be collected before wiping, rebuilding, or applying changes that could erase evidence.
- Expand the investigation beyond the first alert. Check connected systems and the access paths that could have been used to move through the environment. A single affected endpoint does not establish the boundaries of the incident.
- Bring in qualified help and notify the right people. Engage external incident-response expertise if internal capacity, independence, or forensic capability is insufficient. Coordinate with leadership, counsel, communications, business continuity, and authorities as appropriate.
CISA’s November 2022 advisory on an Iranian government-sponsored APT compromise recommends immediate isolation of affected systems, review of relevant logs and artifacts, memory capture and forensic imaging for detailed analysis, consideration of third-party incident-response support, and reporting to CISA or the FBI. It also calls for examining connected systems and domain controllers for lateral movement. Apply that sequence to the activity covered by the advisory; it is not a universal instruction to disconnect every system in every organization.
Should you shut down affected computers or leave them running?
There is no safe universal rule to power off or leave every affected device running. Shutting down can interrupt attacker activity, but it may also destroy volatile evidence such as system memory. Leaving a system online can preserve access for observation, but may allow continued activity. Disconnecting it from the network may limit access while keeping it powered, but the right containment method depends on the device, its role, the evidence, and the risk to people or operations.
Ask the incident lead and qualified responders to decide whether to isolate, shut down, preserve, or otherwise restrict each affected system. If an immediate safety or operational threat requires urgent action, prioritize that risk, document what was done and when, and tell responders which changes were made. Avoid improvising a broad shutdown or cleanup that could disrupt critical services or remove evidence.
#1 Best Overall
- POWERFUL SECURITY KEY: The Security Key C NFC is the essential physical passkey for protecting your digital life from phishing attacks. It ensures only you can access your accounts.
- WORKS WITH 1000+ ACCOUNTS: Compatible with Google, Microsoft, and Apple. A single Security Key C NFC secures 100 of your favorite accounts, including email, password managers, and more.
- FAST & CONVENIENT LOGIN: Plug in your Security Key C NFC via USB-C and tap it, or tap it against your phone (NFC) to authenticate. No batteries, no internet connection, and no extra fees required.
- TRUSTED PASSKEY TECHNOLOGY: Uses the latest passkey standards (FIDO2/WebAuthn & FIDO U2F) but does not support One-Time Passwords. For complex needs, check out the YubiKey 5 Series.
- BUILT TO LAST: Made from tough, waterproof, and crush-resistant materials. Manufactured in Sweden and programmed in the USA with the highest security standards.
How to preserve evidence and determine the scope
Preserve records before cleanup
Have responders identify and preserve relevant records from the systems and services your organization uses. Depending on the environment, these may include identity-provider, cloud, endpoint, network, email, remote-access, and administrator logs. Keep a timeline of alerts, decisions, system changes, and actions taken. Restrict access to collected evidence and coordinate evidence handling with responders and counsel.
CISA’s advisory specifically calls for reviewing logs, data, and artifacts and capturing memory and forensic images for detailed analysis. Wiping or rebuilding before that assessment may remove information needed to understand the intrusion or confirm whether it has been contained.
Do these 3 things before closing this tab:
1Clear out junk files and repair common Windows errors2Scan for outdated or missing drivers - takes under a minute3Repair Windows errors before they cause bigger problemsRank #2
- POWERFUL SECURITY KEY: The YubiKey 5C NFC is the most versatile physical passkey, protecting your digital life from phishing attacks. It ensures only you can access your accounts
- WORKS WITH 1000+ ACCOUNTS: Compatible with popular accounts like Google, Microsoft, and Apple. A single YubiKey 5C NFC secures 100+ of your favorite accounts, including email, password managers, and more
- FAST & CONVENIENT LOGIN: Plug in your YubiKey 5C NFC via USB and tap it, or tap it against your phone (NFC), to authenticate. No batteries, no internet connection, and no extra fees required
- MOST SECURE PASSKEY: Supports FIDO2/WebAuthn, FIDO U2F, Yubico OTP, OATH-TOTP/HOTP, Smart card (PIV), and OpenPGP. That means it’s versatile, working almost anywhere you need it
- PRIMARY & SPARE KEYS: Just like having a spare house key, we recommend buying two YubiKeys - one for daily use and one as a spare. That way you’ll never get locked out of your accounts
Look for movement and access beyond the first system
Investigate connected systems and domain controllers, as CISA recommends for the compromise described in its advisory. Expand the scope according to the evidence and your actual environment: consider identities and privileges, endpoints, cloud services, network paths, and third-party access. CISA and NSA’s advisory on PRC state-sponsored activity describes targeting across enterprise environments and customer-facing systems and provides tactics, techniques, and procedures for detection and threat hunting.
Do not treat the absence of another alert as confirmation that the attacker has lost access. Responders should assess what accounts, systems, and access paths may have been compromised and look for signs of continued or renewed access across the relevant environment.
Who should be involved in the response?
Use one coordinated decision structure rather than running separate technical, legal, and communications responses. Include the CISO or security lead, IT and cloud administrators, executive decision-makers, legal counsel, communications, business-continuity leads, and owners of affected products or services. Involve the cyber insurer or managed provider if existing arrangements require or support it.
Rank #3
- POWERFUL SECURITY KEY: The YubiKey 5 NFC is the most versatile physical passkey, protecting your digital life from phishing attacks. It ensures only you can access your accounts
- WORKS WITH 1000+ ACCOUNTS: Compatible with popular accounts like Google, Microsoft, and Apple. A single YubiKey 5 NFC secures 100+ of your favorite accounts, including email, password managers, and more
- FAST & CONVENIENT LOGIN: Plug in your YubiKey 5 NFC via USB and tap it, or tap it against your phone (NFC), to authenticate. No batteries, no internet connection, and no extra fees required
- MOST SECURE PASSKEY: Supports FIDO2/WebAuthn, FIDO U2F, Yubico OTP, OATH-TOTP/HOTP, Smart card (PIV), and OpenPGP. That means it’s versatile, working almost anywhere you need it
- PRIMARY & SPARE KEYS: Just like having a spare house key, we recommend buying two YubiKeys - one for daily use and one as a spare. That way you’ll never get locked out of your accounts
- Name one incident lead to coordinate decisions, status, and workstreams.
- Set up a trusted communications channel that does not depend on accounts or systems that may be compromised.
- Coordinate external communications with counsel and communications leads. Keep unverified indicators and sensitive incident details out of ordinary external messages.
- Bring in incident-response expertise when needed. Consider state-sponsored intrusion experience, forensic and cloud or identity expertise, availability, independence, evidence-handling practices, scope, deliverables, and commercial terms. Government advisories cited here do not rank or endorse commercial providers.
CISA leadership guidance calls for incident plans to include senior business leadership and board members, and for senior management to empower the CISO in company risk decisions. A tabletop exercise can establish in advance who may approve containment, service interruptions, customer communications, and recovery decisions.
Free tools Windows power users keep installed
One-click scans. No signup required.
Who should you report the incident to, and when?
Reporting channels and legal duties depend on where the organization operates, its sector, contracts, the information affected, and the incident facts. Have counsel determine promptly whether mandatory reporting applies and identify the relevant agency or regulator. A voluntary report does not substitute for a legally required one.
Rank #4
- POWERFUL SECURITY KEY: The Security Key NFC is the essential physical passkey for protecting your digital life from phishing attacks. It ensures only you can access your accounts.
- WORKS WITH 1000+ ACCOUNTS: Compatible with Google, Microsoft, and Apple. A single Security Key NFC secures 100 of your favorite accounts, including email, password managers, and more.
- FAST & CONVENIENT LOGIN: Plug in your Security Key NFC via USB-A and tap it, or tap it against your phone (NFC) to authenticate. No batteries, no internet connection, and no extra fees required.
- TRUSTED PASSKEY TECHNOLOGY: Uses the latest passkey standards (FIDO2/WebAuthn & FIDO U2F) but does not support One-Time Passwords. For complex needs, check out the YubiKey 5 Series.
- BUILT TO LAST: Made from tough, waterproof, and crush-resistant materials. Manufactured in Sweden and programmed in the USA with the highest security standards.
For organizations in the United States
The CISA advisory on the Iranian APT compromise identifies CISA and the FBI as reporting channels. A later joint CISA advisory also advises organizations to consider mandatory reporting requirements to relevant agencies and regulators under applicable laws and regulations, alongside voluntary reporting to appropriate cyber or law-enforcement agencies. CISA’s small-business guidance says victims should report promptly; reporting can help agencies understand targeting, deploy resources, and share warnings. Confirm current contacts and procedures on official agency pages because they can change.
For organizations outside the United States
Contact the national cyber authority and law enforcement, and consult local counsel about privacy, sector-regulator, contractual, and other notification duties. The cited sources do not establish a single reporting channel or deadline that applies worldwide.
Best Value
- POWERFUL SECURITY KEY: The YubiKey 5 is a versatile physical passkey that protects your digital life from phishing attacks. It ensures only you can access your accounts.
- WORKS WITH 1000+ ACCOUNTS: Compatible with popular accounts like Google, Microsoft, and Apple. A single YubiKey 5 secures 100+ of your favorite accounts, including email, password managers, and more.
- FAST & CONVENIENT LOGIN: Plug in your YubiKey 5 via USB and tap it to authenticate. No batteries, no internet connection, and no extra fees required.
- MOST SECURE PASSKEY: Supports FIDO2/WebAuthn, FIDO U2F, Yubico OTP, OATH-TOTP/HOTP, Smart card (PIV), and OpenPGP. That means it’s versatile, working almost anywhere you need it.
- BUILT TO LAST: Made from tough, waterproof, and crush-resistant materials. Manufactured in Sweden and programmed in the USA with the highest security standards.
How to recover after containment
Do not equate removing visible malware with eradicating an intrusion. Work with responders to assess compromised identities and systems, determine which access or persistence mechanisms need to be revoked, and validate the environment before restoring operations. Restore only from sources the team has assessed as known-good, after protecting backups and recovery credentials. Document the incident, remediate weaknesses implicated by the evidence, and monitor for recurrence.
Quick wins for a faster PC:
Repair Windows errors before they cause bigger problemsFix Now →Fix the driver behind crashes, sound loss and screen glitchesFind Drivers →The recovery sequence must fit the incident and environment. The cited advisories support investigation, eradication, and mitigation, but do not prescribe one restoration process for every organization.
What to improve after the incident
Once the active response is under control, use the findings to strengthen preparedness and account protection. CISA recommends phishing-resistant multifactor authentication (MFA) where feasible. FIDO/WebAuthn is one phishing-resistant option: an authenticator may be a roaming physical USB or NFC token, or one built into a laptop or phone.
Before selecting an authenticator, check support across your identity provider and applications, enrollment and account-recovery procedures, backup authenticators, manageability, and accessibility for users. A physical security key can be part of an MFA plan; it does not detect, investigate, or contain an active intrusion.
Quick Recap
Product prices and availability are accurate as of the date/time indicated and are subject to change. Any price and availability information displayed on Amazon at the time of purchase will apply.
