Talk to us
CASE STUDY: INCIDENT RESPONSE
A NZ business with a considered cybersecurity investment was compromised when stolen credentials were used to lock their servers with Bitlocker. A ransom note appeared on the admin desktop. Just over five hours later, they were back live, secure, and hardened. This is how it happened.
THE CHALLENGE
At 6.18am, a NZ business with a considered cybersecurity investment was compromised. A "known user's" credentials, stolen during overseas travel, had been used from India to elevate privileges, lock the servers with Bitlocker, and leave a ransom note on the admin desktop. By the time the team arrived at the office, the business was effectively offline.
THE RESPONSE
ACIT immediately isolated internet access and terminated the suspicious offshore connections. We ran forensic analysis on Watchguard endpoint logs to trace the intruder's path through the environment. Servers and firewalls were deep-reviewed and cleaned. MFA with geo-locking was added to VPN access. By 11.30am, just over five hours from first symptom, the business was back live and secure.
THE OUTCOME
Mission-critical data stayed protected. Downtime was minimal. The client moved forward not just back to where they were, but to a hardened posture, with clearer geo-controls, tighter MFA, and a team that had now lived through an incident and knew what to expect. The strongest defences are often built immediately after a real attack.
WHAT CHANGED
WHAT THE RESPONSE LOOKED LIKE
Internet access isolated immediately, suspicious offshore connections terminated. Stops the attacker doing anything else while we work out what they've already done.
Watchguard endpoint logs reviewed to map exactly where the intruder went, what they touched, and what they tried. No assumptions, just evidence.
Every server and firewall examined and cleaned. The environment isn't trusted again until we're sure nothing has been left behind.
The vector that let them in is closed. Multi-factor authentication added across the board, with geo-locking so a credential alone can't be used from offshore.
"Live and secure by 11.30am, just over five hours from first symptom to business as usual."
— ACIT Incident Response, in one line
Most businesses find out the hard way. A security review tells you in advance, what your exposure is, what your response would look like, and what closing the gaps would cost.
Book a security review