Ransomware on File Servers with Domain-Joined Backups
A 500-user professional services firm suffers a ransomware incident on Monday at 06:40. Three file servers, FS01-FS03, hold 12 TB total. By 08:00, roughly 4 TB is encrypted, and ransom notes point to a domain admin account used over RDP from a workstation the previous Friday. Backups are Veeam jobs to a NAS at 01:00 daily; the NAS is domain-joined, and its SMB share is mounted on FS02 for a reporting script. A cloud immutable copy replicates the NAS at 02:00 daily, giving a 24-hour RPO. The last successful Veeam job completed Sunday at 01:15. The immutable copy has not yet been tested for restore. The company has no EDR on servers, uses flat internal routing, and allows domain admins to log on to workstations. Leadership wants restoration by Wednesday and asks whether to pay the ransom.
1. What immediate containment and evidence-preservation actions should be taken, and in what order?
Read the worked answer
Contain spread first, then preserve, then scope. Isolate FS01-FS03 and the suspected workstation from the network at the switch or hypervisor level, but do not power them off if memory capture is feasible and policy allows. Disable the compromised domain admin account and any other accounts that logged on to the file servers, and reset service account passwords. Block SMB and RDP between user segments at the firewall or segmentation gateway. Preserve Veeam logs, NAS logs, Windows event logs, firewall logs, and EDR telemetry from any remaining endpoints before rebuilding. Identify the RDP source and check domain controller logs for the account's authentication history. Only after containment should the team start wide-scale restoration, because restoring into a still-compromised network risks re-encryption.
2. Evaluate the backup recovery options and determine a safe restore sequence.
Read the worked answer
The NAS is not trustworthy for immediate restore: it is domain-joined and its SMB share was mounted on an encrypted server, so the attacker may have had access to backup files or credentials. The cloud immutable copy is the better source, but it must be validated. Restore a sample to an isolated environment, verify file integrity and malware-free content, and confirm the copy predates the intrusion. Because the RPO is 24 hours, data from Sunday 01:15 to Monday 06:40 may be lost; leadership should decide whether that is acceptable before paying. Rebuild FS01-FS03 from known-good media rather than cleaning the existing OS, reset all privileged credentials, and restore data in order of business criticality. Do not reconnect restored servers to the flat network until segmentation and monitoring are in place.
3. Identify the defense-in-depth failures and prioritize the fixes.
Read the worked answer
The flat internal routing allowed lateral movement from a workstation to file servers. Domain admins logging on to workstations exposed privileged credentials to theft. The backup NAS was domain-joined and mounted on a production server, which tied backup integrity to the compromised domain. There was no EDR on servers and no tested restore. Prioritize tiered administration and removal of domain admin rights from workstations, then network segmentation between user, server, and backup zones. Isolate backups with separate credentials, immutable storage, and no production SMB mounts. Deploy server EDR and central logging. Finally, run a restore test and tabletop exercise before Wednesday. Paying the ransom does not address any of these failures, does not guarantee decryption, and may fund criminal activity; it should not be the recovery plan.