1 The Challenge
This is an anonymized account of a ransomware incident response engagement, kept accurate to the mechanics involved. It’s a common enough path into a business that it’s worth walking through in detail.
How it started
An employee opened an email attachment that appeared to be an invoice from a supplier the company genuinely worked with. The attachment ran a script that quietly established a foothold on the employee’s workstation, and over the following two days the attacker moved laterally through the network using credentials harvested from that first machine, slow and deliberate, not an immediate smash-and-grab.
By the time the ransomware payload triggered overnight, it had reached the company’s main file server and several other workstations. Staff arrived the next morning to encrypted file shares and a ransom note.
2 Our Assessment
Scoping the damage
The first priority was determining what was actually encrypted versus what the attacker had merely touched, and whether the attacker still had active access. We isolated affected systems from the network immediately, then worked through logs to trace the two-day dwell time between the initial phishing click and the ransomware trigger, identifying every system the attacker had reached in between.
The scoping also turned up that the company’s backups, while they existed, had a gap: the most recent successful backup was four days old, and one file server hadn’t completed a backup in over two weeks due to a silent failure nobody had noticed.
3 The Solution
With scope confirmed and the attacker’s access cut off, recovery moved on two tracks at once: rebuilding affected systems from clean images rather than trusting anything the attacker had touched, and restoring data from the most recent viable backup rather than paying the ransom. The four-day-old backup meant some recent work had to be manually reconstructed from email attachments and other secondary sources, workable, but avoidable with a tighter backup schedule.
Once systems were back online, we addressed the actual entry point and the gaps the incident exposed:
- Deployed endpoint detection and response (EDR) across all workstations and servers, replacing signature-only antivirus that hadn’t flagged the initial script
- Fixed the silent backup failure and moved to backups verified by scheduled test restores, not just a completion notification
- Rolled out phishing-simulation training and reporting, since the initial email would have been stopped by a more skeptical read
- Segmented the network so a single compromised workstation no longer has a direct path to every file server
- Enforced MFA on all remote and administrative access company-wide
4 The Result
The business was fully operational within four business days without paying the ransom, using a combination of restored backups and reconstructed recent work. No client data was confirmed exfiltrated based on the available logs, and the entry point and lateral-movement path the attacker used were both closed before systems went back into production.
5 Business Impact
For a 30-person firm, four days of disrupted file access and staff time spent on recovery is a real cost, but it’s a fraction of what a longer outage, a paid ransom with no guarantee of a working decryption key, or a client-data breach notification would have cost. The four-day gap in backups is the detail worth other businesses paying attention to: a backup that exists but hasn’t been verified recently is a false sense of security, discovered at exactly the wrong moment.
If your business hasn’t tested a full restore from backup recently, or isn’t sure how long the attacker would have to move around before anything looked wrong, those are worth checking now rather than during an actual incident. Our incident response and data recovery & backup teams can help with both.