In an international bank, the IT security team identified unusual network traffic indicating a potential...

ECIH v3 malware incident handling emphasizes containment when compromised systems are actively communicating with command-and-control infrastructure. Disconnecting the affected servers from the network immediately disrupts the attacker ' s communication channel, restricts further command execution, and prevents continued exfiltration of sensitive banking information. A memory dump is valuable for forensic analysis because it can preserve running processes, connections, and malicious artifacts, but collecting evidence should not permit an active compromise to continue causing damage. Updating antivirus signatures is a preventive or eradication-related action and may not stop an established C2 session. A controlled shutdown could destroy volatile evidence and may not be the safest immediate response. Therefore, network isolation is the strongest immediate containment action while preserving the servers for subsequent forensic investigation.

================