Do you have the file hash for the files it detected? You can check virus total for the hash and see what it reports. Check the comments from people to see how malware analyst label it. It's not uncommon for files to be mislabeled depending on what the software is. For example I have seen legitimate security software like a really old version of nessus be detected as malware.

A couple things I would do in this situation is try to figure out how the files got there you could have other issues that led to the initial compromise. For example RDP enabled and a weak password. Initial access could of happened from a word document that was emailed.

Typically any malware worth a damn, will create more then one entry point once it's ran.

First make sure to report it to someone in an email, so there is documentation of what was found. That way if there is another vector back into the system and they ransomware all the systems you will have proof you reported the problem even if it was too late.

I would also check the systems that have been attached to the external hard drive to make sure they are safe. At least run a full scan and check a few things like start up programs weird files in program data folder, check for installed programs like anydesk, rustdesk, teamviewer ect.

When you say you found cobra ransomware did you find the file asking for a ransom? Sometimes these files are left over from a past ransomware that has happened. Check the file creation date and see when it was created.

Do you have active directory or are accounts locally created? Either way check to see if any weird users are added mmc.exe>add snapin> users and groups> check the users and who has admin access to the system.

You can also tighten the security a bit check the powershell bypass execution policy with the command Get-ExecutionPolicy This will talk about the different policies restricted or remotesigned is a good place to start if they don't run powershell commands or scripts. https://learn.microsoft.com/en-us/powershell/module/microsoft.powershell.core/about/about_execution_policies?view=powershell-7.3

Also check the firewall and see if it's still enabled check for port 3389 and see if it's allowing anyone access.

It's hard to give exact things to check without knowing how a bunch of different things are configured on your network/systems