Active ransomware outbreak

At 03:40 monitoring pages on-call: dozens of internal file shares and three Windows app servers show CPU pegged and disk I/O saturated, and users report files renamed with a '.locked' extension plus a ransom note dropped in every directory. EDR shows a process spawning from a recently-patched VPN appliance host, then SMB connections fanning out to other hosts using a domain admin credential. Backups run nightly to a network share mounted on the same domain. How do you triage, contain, and remediate an active ransomware outbreak?