"(2) Restore from backups"
Not a sure thing. One of my colleagues got hit, and evidently the ransomware was injected months before the attack, so the backup was infected also.