Ransomware at a Manufacturer With Shared AD and OT
At 02:14 on a Tuesday, an EDR alert reports six Windows servers encrypting files at Halden Metalworks, a 900-employee manufacturer with three plants. The domain admin account used appears in 40 authentication events across two plants. The backup server is domain-joined and reachable from the corporate LAN; the immutable cloud copy is 22 hours old and replicates every 24 hours. The OT network is separated by a firewall but shares the same AD domain, and plant engineers use domain accounts on HMI workstations. Twelve hosts have no EDR agent because of an old image, and the SOC has no packet capture, only NetFlow. The attacker appears to have used a residential proxy for C2 over TLS, and 3.1 GB left the network in the last 24 hours. The CEO is asking whether to shut all three plants, and Legal has asked when the 72-hour GDPR clock starts.
1. Set out the containment sequence for the first four hours. What would you do first, and what are the trade-offs?
Read the worked answer
Protect the recovery path before chasing the encryptor. Isolate the backup server from the corporate LAN, remove its domain dependency where possible, rotate its credentials and confirm the immutable copy cannot be deleted by the compromised domain admin. Then disable the compromised domain admin account and revoke its sessions and tickets, and block the residential proxy and known C2 indicators at egress. Isolate the six encrypting servers and the hosts with matching authentication events using EDR network containment, not power-off, so memory and keys are preserved.
Separate IT from OT at the firewall and break the shared trust: block AD authentication from OT to corporate domain controllers and disable shared accounts used on HMI workstations. Do not shut the plants by default. In metalworks, stopping a furnace or a line can create safety and physical-damage risk, and the CEO's question is an availability and safety decision, not a security one. Keep OT running under manual supervision while cutting its IT dependencies. If the firewall shows lateral traffic into OT, then a controlled plant stop is justified.
The trade-offs are explicit: isolating hosts loses some volatile evidence and may interrupt production; keeping plants online preserves safety but leaves a path if IT and OT trust is not truly severed. The immutability of the cloud copy buys time, but a 22-hour-old copy means up to a day of data loss, so do not restore until scope is known or the attacker may re-encrypt the restored estate. Preserve NetFlow and EDR triage before reimaging.
2. How would you determine scope with twelve unmanaged hosts and only NetFlow? What specific evidence would you prioritise?
Read the worked answer
Start from identity and network telemetry, because the attacker used domain credentials. Pull domain controller logs for the compromised account and for all accounts that authenticated from unusual sources in the preceding seven days, focusing on 4624 logons, 4768 and 4769 Kerberos tickets, and service creation. Correlate with NetFlow for SMB (445), RDP (3389), WinRM (5985/5986) and LDAP (389/636) between servers and toward the unmanaged hosts. Look for the 3.1 GB egress pattern, not just the proxy: large outbound flows to unfamiliar destinations, DNS queries for new domains, and TLS sessions at odd hours.
On the unmanaged hosts, deploy the EDR agent through Group Policy or a remote management tool after containment, then hunt for scheduled tasks, new services, WMI persistence, local accounts and encryptor notes. Check the hypervisor and backup infrastructure separately, because ransomware operators target both. Check domain controller replication and the krbtgt account; if domain admin was compromised, assume a golden ticket until krbtgt is reset twice with a defined interval.
The 12 unmanaged hosts are the highest-uncertainty area, so treat them as compromised until proven otherwise and keep them isolated. Build a timeline that ties initial access, privilege escalation, lateral movement, staging and exfiltration. Given 3.1 GB egress, assume data theft and preserve evidence for notification decisions. Without packet capture, use proxy logs, firewall logs and endpoint telemetry to reconstruct the exfiltration channel; absence of evidence is not evidence of absence.
3. Advise Legal on when the 72-hour clock starts and whether to notify. How would you answer the CEO on shutting the plants?
Read the worked answer
The GDPR clock starts when the controller becomes aware of a personal data breach, meaning it has a reasonable degree of certainty that a security incident has led to personal data being compromised. The 02:14 alert is not automatically awareness, but once the team confirmed encryption across servers and 3.1 GB of egress, a personal data breach was likely and the clock should be treated as running from the earlier point. Waiting for full forensics is not a defence. Notify the supervisory authority within 72 hours, by Friday 02:14, unless the breach is unlikely to result in a risk to individuals; given ransomware plus exfiltration in a company holding employee and customer data, that exception is hard to sustain. A phased notification is acceptable: report what is known, state that the investigation continues, and update within the regulator's timeline.
Do not notify affected individuals before counsel has assessed the content and the risk, but prepare the communication. Preserve evidence, record decisions and timestamps, and check whether sector regulators or NIS2-style obligations impose shorter or additional deadlines. Also consider insurer notification and law enforcement, which may affect the wording but not the statutory clock.
On the CEO's question, separate safety from notification. Shutting the plants is an operational decision based on whether IT-OT trust can be severed and whether manual operation is safe. It is not a legal requirement and not a substitute for containment. Give the CEO a clear recommendation: keep plants running with OT isolated and manual supervision if the firewall confirms no OT encryption, and shut only if lateral movement into OT is observed or safety systems are affected.