Double Extortion at a District Co-operative Bank: Nine-Day-Old Tape and a Poisoned Replication
At 02:40 on a Saturday, the SOC of a 68-branch district co-operative bank sees file extensions changing across the core banking application servers. By 06:00, the CBS servers and the virtualised backup appliance, which sits on the same SAN, are encrypted; 340 ATMs and the UPI switch are down. The attacker posts 40 GB of extracted customer data on a leak site and demands USD 300,000 in cryptocurrency within 72 hours. The warm DR site in another city replicates every 6 hours - but it has replicated from the infected primary, so the DR copy is also encrypted. The only clean copy is a weekly tape from nine days ago, vaulted off-site and never restore-tested. Sixty percent of servers run an out-of-support operating system, there is no EDR, and the CISO is a part-time consultant. The MD wants 'the fastest route back to service' and asks whether to pay, whether RBI must be told before Monday, and whether customers should be informed.
1. Set out the first-24-hour sequence and advise the MD on paying the ransom.
Read the worked answer
On the ransom: do not pay. Payment does not guarantee a working decryptor - double-extortion crews routinely ship corrupt keys - it funds the next campaign, it may create sanctions exposure if the wallet is linked to a designated entity, and it turns a recoverable outage into a permanent, disclosable governance failure. RBI's supervisory posture and international ransomware advisories align: payment is not a control. Let negotiation be a law-enforcement matter, and say so in writing to the board.
First 24 hours, in order. (1) Isolate without destroying: cut the WAN link to the DR site and the backup appliance, disable VPN and remote access, disable compromised privileged accounts, reset the domain controller account password twice. (2) Preserve: do not reimage anything until forensic images of the CBS servers and domain controllers are taken; retain firewall, proxy and authentication logs and the ransom note. (3) Engage a CERT-In-empanelled forensic firm and inform the board. (4) Scope: assume the 6-hour replication is poisoned - verify by hashing a sample on the DR array - and treat the nine-day tape as the only clean recovery point. (5) Rebuild rather than decrypt: construct clean servers from a known-good baseline, restore the tape, then replay nine days of transactions from ATM switch journals, UPI/IMPS settlement files and NPCI reconciliation. (6) Restore in priority order: payment switch, then branch CBS, then internal applications.
Honest answer to the MD. A never-tested tape restore in an estate with no EDR is a multi-day exercise under forensic supervision. Promising a Sunday fix is the second incident.
2. What are the bank's reporting obligations and their timing, and what should the board minute?
Read the worked answer
External reporting. (a) CERT-In - within 6 hours of noticing the incident, under CERT-In's directions, covering incident type, affected systems and indicators. (b) RBI - under the incident-reporting requirement of the cyber security framework, in the prescribed format within the short window (hours), with updates as scope becomes clear; a ransomware event with data exfiltration and a payment-system outage is exactly the case that must not be learned from newspapers. (c) NPCI - because the UPI switch and settlement are affected. (d) Police and the NCRP portal - unauthorised access plus extortion warrants an FIR. (e) The Registrar of Cooperative Societies, since member services are disrupted. (f) Affected customers, where the 40 GB includes their data: a factual advisory - change credentials, expect phishing calls referencing real loan details - not speculation.
What the board must minute. Time of detection; classification and severity; the decision not to pay the ransom and the grounds for it; the recovery point actually achievable (nine days) and its customer impact; appointment of the forensic auditor; delegation of authority to the incident committee for restoration decisions; and a dated remediation plan with owners. The minute is the bank's defence - supervisors read it to see whether the board directed the response or merely heard about it afterwards.
Judgement point. Reporting early with an incomplete picture is always cheaper than reporting late with a complete one. The scope will change; the obligation does not wait for certainty.
3. With a constrained budget, which three control deficiencies would you fix first, and in what order?
Read the worked answer
Priority 1 - backup architecture. The backup appliance was online and on the same SAN, and DR replication faithfully copied the encryption. The fix is modest against the loss: a 3-2-1 design with one immutable or air-gapped copy plus one offline copy, and a documented quarterly full-restore test of the CBS. Without a tested restore, every other control is decoration.
Priority 2 - endpoint and identity. No EDR and widespread standing administrative rights explain the lateral movement. Deploy EDR on servers and privileged endpoints, enforce MFA on VPN and administrative access, introduce privileged access management, and strip standing domain-admin rights. This is largely licence and process cost, not capital.
Priority 3 - lifecycle and segmentation, funded over twelve months. Sixty percent of servers on an out-of-support OS is an unpatchable estate; commit to a dated migration and segment the ATM network and branch network away from the data centre to limit blast radius next time.
No-cost items, do them immediately. A board-approved incident-response and communication plan; a CISO with a defined reporting line to the board rather than a part-time consultant; and one tabletop exercise a year with the MD in the room. Note the pattern: the nine-day tape and a nine-day CCTV retention are the same disease - retention and testing are policy decisions that cost little to write and are the first things an attacker and an auditor both test.