During regular maintenance tasks, an application support team noticed an abnormal activity on an Amazon EC2 instance that is configured with an EBS volume. The team immediately informed a Security Engineer of the anomaly. The instance is part of an Auto Scaling Group fronted by an Elastic Load Balancer. What immediate steps should the Security Engineer take for preventing any further attacks to secure the connecting systems and understand the root cause?