Ransomware on a Backup-Connected File Server
At 02:14, EDR alerts on a file server encrypting documents at a small manufacturer. The backup NAS is mounted as a drive on that server, and the last nightly backup completed 26 hours ago. Order entry has a four-hour recovery time objective. The ransom note demands payment in 72 hours. The on-call analyst sees the server still reachable, the EDR console showing the malicious process, and a domain admin logged in from an unfamiliar workstation. The plant runs 24/7 and production scans depend on the file share. The company has no tested incident-response plan and one IT generalist on site.
1. What containment sequence should the analyst direct in the first hour, and why?
Read the worked answer
Contain the spread before restoring data. First isolate the file server and the unfamiliar workstation from the network at the switch or EDR level, but preserve power and memory if possible for evidence. Disable the compromised domain admin account and reset privileged credentials, because the attacker may still have domain access. Disconnect or unmount the backup NAS from the server so encryption cannot reach backups. Block known command-and-control indicators at the firewall. Do not immediately wipe or reimage until forensic images or at least volatile data and logs are captured. Notify management and the plant lead so production can switch to manual workarounds. The order matters: isolation and credential revocation stop ongoing damage; backup protection preserves recovery options; evidence preservation supports later scope analysis.
2. Should the team restore from the 26-hour-old backup immediately to meet the four-hour RTO?
Read the worked answer
Not blindly. First verify the backup is clean and restorable: check backup logs and catalog integrity, scan restored files in an isolated environment, and confirm the NAS was not mounted during the encryption window. Restoring to the original server before credential compromise is resolved risks re-infection. The four-hour RTO applies to order entry, not necessarily the whole file server. A better judgement is to restore the minimum order-entry service to a clean, segmented host with new credentials, then restore broader file data in phases. If the backup is suspect, use an older immutable copy or rebuild. Communicate a realistic recovery time rather than promising four hours without verification.
3. What should leadership communicate internally and externally during the first day?
Read the worked answer
Leadership should state known facts, containment actions, and the next update time, while avoiding speculation about data theft or attribution. Internally, tell production staff which systems are unavailable and the manual workaround; tell employees not to pay the ransom or contact the attacker. Externally, notify legal counsel and check contractual and regulatory notification obligations, but do not send customer notices until scope and data exposure are assessed. The ransom deadline should not drive the technical recovery timeline. Preserve the note and any attacker communications as evidence. A single spokesperson and a written update cadence reduce rumor and inconsistent messages.