Recently, ransomware attacks become more frequent. When malware infects your computer, all files (including network drives, shared folder) on your computer will be encrypted and cannot be open or read, in order to blackmail users to pay for their files decryption. According to a recent attack activity research report, hackers successfully invaded a target organization by advanced persistence APT (Advanced Persistent Threat). After obtaining the domain administrator authority, the ransomware distributed by group policy and spread out to achieve a maximum range of data encryption purposes. Members are advised to be vigilant and check the routine scheduling and delivery mechanisms regularly. The causes of the incident should be clarified in depth to avoid missing the opportunity for investigation. In addition, traditional ransomware transmits by application vulnerabilities (e.g. Flash Player) and social engineering. It is recommended that all members apart from strengthening the organization's information security protection, also constantly check the relevant application updates, back up important files regularly, strengthen information security awareness and avoid opening unknown emails or links.