Ransomware is a threat to companies of all sizes, and the best defense is still early detection and prevention. Using security monitoring systems and skilled analysts in a Security Operations Center, detect the early stages of any malware or computer intrusion and stop it before the threat actors have time to gain administrator access and fully take over the victim company’s servers. Whenever a threat is detected and stopped, if company policy allows sharing the information about the attempted attack with law enforcement (typically the FBI or US Secret Service in the United States), those tips from the public are crucial for starting investigations that can eventually lead to the identification and arrest of the criminals responsible. Sharing anonymized information with other companies about how the attack happened can also help them detect attacks more accurately and stop them in the early stages. Ransomware gangs won’t stop attacking until they are brought to justice but sharing information about attackers with law enforcement and the information security community can help many companies avoid becoming victims in the future.

https://www.europol.europa.eu/newsroom/news/ransomware-gang-arrested-in-ukraine-europol%E2%80%99s-support