How would you handle a ransomware alert originating from a project manager's device at a remote site for AMD Construction Group?