First isolate the node with a quarantine sandbox. Next run a full integrity check on all code paths and enforce strict code signing. Then deploy a fail‑fast kill switch that drops the process and disconnects it from the network before any persistence code can execute. Add a watchdog that logs every action and alerts if any rule is breached. Finally, schedule automated audits and wipe any residual data. That guarantees no spread.

I’ll schedule the plan for nightly runs on the designated control server, enforce checksum validation before each launch, and archive every log file with a timestamped hash. That way any deviation shows up instantly.