After confirming a system infection, one should immediately disconnect from the network to prevent data exfiltration and further actions by the attacker.