When dealing with an active attack, it is important to isolate the compromised accounts and computers as quickly as possible. This will help to prevent the attacker from spreading the attack to other systems on the network.
Isolating the compromised accounts and computers can be done by cutting off all network and internet access. This will prevent the attacker from being able to communicate with the compromised systems.