This scenario describes an active malware infection with confirmed command-and-control (C2) communication, which represents an immediate and severe risk to sensitive financial data. According to the EC-Council ECIH malware incident handling process, the first priority in such cases is containment, specifically stopping ongoing malicious activity and preventing further data exfiltration.

Option A is correct because disconnecting the affected servers from the network immediately severs the attacker’s control channel and halts outbound data leakage. ECIH emphasizes that when C2 traffic is observed, responders must act decisively to isolate compromised systems before pursuing deeper forensic analysis or remediation. Containment minimizes damage and reduces legal, financial, and reputational impact.

Option B may preserve system state but allows continued exfiltration until shutdown is complete and may disrupt critical banking operations. Option C is a preventive measure and does not stop an active infection. Option D is valuable for investigation but should occur after containment, not before.

ECIH guidance consistently prioritizes stopping harm over gathering evidence when critical assets are at risk. Therefore, immediate network disconnection of affected servers is the correct triage action.