A company has been struck by a ransomware attack which has left their files encrypted. Prior to this incident, the company followed a strict data backup policy. In order to restore operations and recover from the attack, which of the following is the BEST immediate action?
Rebuild the affected systems from scratch
Pay the ransom to quickly regain access to the encrypted files
Restore from last known good backups
Isolate the infected systems and then negotiate payment with the attackers