Ransomware on a Sales File Share with 14 Unmanaged Endpoints
At 09:20 on a Tuesday, the service desk receives three calls from the sales department: Excel files on the shared drive fileserver01/sales open as gibberish and have been renamed with a .locked extension. A text file named READ_ME.txt asks for payment in Bitcoin. The fileserver is Windows Server 2016; the sales share is mapped to 60 Windows 10 workstations. Antivirus is managed centrally, but the console shows 14 endpoints have not checked in for 9 days and signature updates are 21 days old. Two of those endpoints are in sales. The nightly backup copies the sales share to a NAS in the same server room using robocopy, and the last run completed at 23:00 the previous night. The company has no tested disaster recovery plan, and management wants to know whether to pay, restore, or rebuild.
1. Set out the first four hours of incident response in order. Justify each containment step by the risk it reduces.
Read the worked answer
0-15 minutes: declare and scope. Treat this as a major security incident, appoint an incident manager, and notify management and legal. Do not pay; payment funds the attacker, may not produce a working decryptor, and can expose the company to sanctions. Ask the service desk for the exact time the first file failed and which users opened the file.
15-45 minutes: contain. Isolate the affected workstation and the file server at the switch or EDR level, not by shutting them down, so volatile evidence and encryption logs are preserved. Disable the mapped drive for all sales users. Quarantine the 14 non-reporting endpoints immediately; they are unmanaged and may already be compromised. Block known command-and-control indicators at the firewall and proxy, and disable SMBv1.
45-90 minutes: identify. Check the file server for the number and age of encrypted files, SMB sessions, Windows event logs and local accounts. Check the antivirus console for the last check-in and detected threats. Look for persistence: scheduled tasks, services, run keys, new local administrators. Determine whether any account with broad share access was used.
90-180 minutes: eradicate and protect. Reset credentials for affected users and, if domain compromise is suspected, follow the domain-controller recovery procedure including a double KRBTGT reset. Rebuild infected endpoints from known-good images rather than cleaning them. Patch the initial-access vector once identified.
180-240 minutes: restore cautiously. Restore only after verifying that the backup is clean and scanning it in an isolated network. Restore to a temporary share first and compare file counts and samples. Communicate hourly to staff and management, and preserve a timeline for regulators and insurers.
2. Assess the restore options: the robocopy copy on the NAS and the 21-day-old signatures. What do you check before restoring, and what is the risk of restoring from that copy?
Read the worked answer
The robocopy copy is a mirror, not a backup. If the job ran after encryption began, it may have copied encrypted files over clean ones. Because the NAS is in the same server room and likely reachable with the same credentials, it may also be encrypted or deletable by the same malware. The 23:00 completion time is helpful only if the infection began after that; it does not prove the copy is clean.
Checks before restoring.
- Compare file counts, sizes and timestamps between the share and the copy, and search the copy for
.lockedfiles andREAD_ME.txt. - Check whether the NAS has snapshots or previous versions from before the incident. A snapshot is more trustworthy than a live mirror.
- Review the robocopy logs for errors, skipped files and the exact source and destination used.
- Mount the copy on an isolated host and run a full offline scan with current signatures plus EDR. Do not rely on the 21-day-old signature set; update it and use behavioural detection.
- Check the NAS access logs for writes from the infected workstation.
- Confirm that permissions and ownership will survive the restore.
Risk. Restoring an infected copy can reintroduce the malware, overwrite good data, or restore an incomplete set. If only the file data is restored, NTFS permissions, share mappings and links may be missing. If the backup was made while files were being encrypted, it may contain a mix of good and bad versions. Therefore restore to an isolated location first, validate with the business owner, and only then replace the production share. Keep the original share read-only until the investigation is complete. Rebuilding the file server may be safer than restoring onto a compromised operating system.
3. Draft a 30-day remediation plan covering endpoint management, backup, and user awareness. Give owners, measurable exit criteria, and the reasoning for the priority order.
Read the worked answer
Days 1-3: contain and inventory. Owner: IT security. Isolate or rebuild the 14 non-reporting endpoints, force antivirus check-in and signature updates, and confirm EDR coverage on every endpoint. Exit criteria: 100% of endpoints report to the console, no endpoint has signatures older than 24 hours, and no unauthorised SMB shares exist. This comes first because an unmanaged endpoint is an open door.
Days 4-10: make recovery possible. Owner: infrastructure team. Implement 3-2-1 backups for the sales share: local snapshot, a separate backup server, and an offsite immutable copy. Use a dedicated backup account that cannot be used interactively, restrict NAS write access, and enable object lock or offline media. Run a full restore test to an isolated share. Exit criteria: a documented restore of a 10 GB sample in under four hours, and a verified clean copy from at least three restore points. Backup comes second because containment without recovery leaves the business exposed.
Days 11-20: reduce likelihood. Owner: desktop team. Establish a patch baseline, require critical patches within seven days, remove local administrator rights, disable macros from the internet, and block execution from temp directories. Run an authenticated vulnerability scan. Exit criteria: 95% patch compliance and zero critical findings on internet-facing systems.
Days 21-30: people and process. Owner: security awareness lead with HR. Run phishing simulation and training that includes reporting suspicious attachments and extensions. Publish a one-page incident contact card and test it. Hold a tabletop exercise for ransomware. Exit criteria: report rate above 60%, and an incident response plan signed off by management. Awareness comes last only because the technical controls must be in place first; it is not optional.
Report weekly on the metrics, with named owners and dates.