Restoring critical systems after a ransomware incident

Contain the incident and preserve evidence

I stopped device use, isolated the network and kept company-issued devices onsite. I investigated the immediate scope of the incident and captured available volatile memory and process information before the IT manager began restoring the servers. He confirmed that protected database backups were available and led the server and database recovery.

Restore a usable working environment

I prepared six clean Windows installation drives and reimaged workstations in parallel. I then reinstalled Microsoft 365 and the locally installed quoting client, and reset affected network-connected equipment as part of preparing the environment for reconnection. This work ran alongside the server and database restoration.

Investigate the intrusion and the likely credential exposure

Following the recovery, I worked with an external incident-response specialist to investigate how the attack unfolded. We identified the ransomware as 8Base, a variant of the Phobos ransomware family, and traced the likely initial entry point to a malicious email attachment received from a compromised partner financier.

The investigation also uncovered a significant vulnerability in PackEdge, our locally installed quoting application. Its compiled executable contained database credentials in readable plaintext. Because PackEdge connected directly to the database, we identified this as the most likely source of the credentials used by the attackers to access our databases.

However, the available logs and memory dumps did not provide sufficient evidence to confirm that the attackers had obtained the credentials from PackEdge. The finding nevertheless exposed a serious security weakness, and required that the application’s owner remediate the vulnerability.

Turn the investigation into practical prevention

I required the owner of PackEdge to address the plaintext database credentials bundled with the installed client. I also asked the IT manager to strengthen email scanning and threat detection in our Microsoft environment. Those were separate remediation requests; my role was to identify the risks and press for them to be addressed.

I implemented twice yearly cybersecurity awareness training focused on email diligence, tailoring sessions to situations employees encountered in their day-to-day work. I also made cybersecurity training mandatory for new employees during onboarding.

I set up a dedicated cyber-threat reporting inbox so anyone in the business could ask for help with a suspicious email, attachment or other potential threat. Most reports were false alarms, but the inbox gave staff a clear action to take instead of making the decision alone. It also surfaced a highly targeted spear-phishing campaign aimed at the operations manager and both directors.

Establish a path away from on-premises infrastructure

The longer-term outcome was that I was given authority to begin moving on-premises infrastructure to Azure. The incident and follow-up investigation turned infrastructure modernisation from a proposed improvement into an authorised workstream. That authority was the outcome at this stage; it should not be confused with a completed cloud migration.