Ransomware in Mexico: early signs and a 24-hour response plan

How to detect ransomware before mass encryption and what to do in the first 24 hours to contain, preserve evidence, and restore operations.