Ransomware staging before detonation

A canary/honeyfile on a file server is read and modified at 02:50, an alert you've never seen fire before. EDR then shows a signed-but-uncommon binary staged in C:\ProgramData on 14 hosts and a scheduled task created on each to run it at 06:00. Nothing is encrypted yet; users are asleep; ops looks normal. Threat intel matches the staging pattern to a ransomware affiliate that detonates fleet-wide on a timer. You have ~3 hours before the scheduled tasks fire. How do you triage, contain before detonation, and avoid tipping off an attacker who may still be watching?