Ransomware on an End-of-Life ERP Segment
A food manufacturer runs three plants on a single ERP instance that reached end-of-life 18 months ago. At 02:10 on a Sunday, the SOC sees two ERP application servers encrypting files and a lateral movement alert from a file server holding production recipes. The company has immutable backups from 36 hours earlier, but the ERP vendor will not support restore on the EOL version without a paid emergency engagement. Plant 1 is running a 24-hour cook line; stopping it wastes $300k of inventory. The OT network is segmented from IT by a firewall, but a vendor VPN terminates on the same file server for maintenance. The incident response retainer has one forensic lead available in 6 hours. A ransom note demands 40 BTC and claims 2 TB exfiltrated. The company has no cyber insurance for ransomware.
1. What are the first 60 minutes actions, and what would you not do?
Read the worked answer
First 60 minutes: activate the incident response plan and bridge; isolate the two encrypting servers and the recipe file server from the network without powering them off; disable the vendor VPN; preserve logs and memory where feasible; block known command-and-control indicators; notify plant managers so they can switch to manual or local procedures; engage the retainer and legal. Check whether backups are reachable from the compromised domain and protect them. Do not wipe or rebuild yet, do not pay the ransom, do not reconnect the VPN to restore maintenance, and do not assume the OT network is safe just because a firewall exists. Assign one person to evidence preservation and one to business continuity so the response does not confuse speed with destruction of evidence.
2. Choose between restoring from the 36-hour backup and rebuilding the ERP. Justify with business and security criteria.
Read the worked answer
Neither choice is automatic. Prefer restore only after proving the backup is clean and the restore environment is isolated. A 36-hour backup limits data loss, but the malware may have persisted earlier than 36 hours, and restoring into the same domain can reinfect. Rebuilding the EOL ERP reduces confidence in a compromised binary but may take weeks and lacks vendor support. A staged approach is best: restore to an isolated segment, scan and validate integrity, test reconciliation against plant records, then reconnect in phases. Keep Plant 1 on manual control until the restored system is proven. Weigh $300k inventory loss against the risk of reintroducing ransomware and the cost of emergency vendor support. Document the decision criteria and the residual risk.
3. How should the vendor VPN and OT segmentation change the incident scope and communication?
Read the worked answer
Treat the vendor VPN as a probable lateral path and the OT environment as potentially exposed until firewall and VPN logs prove otherwise. The VPN terminating on the recipe file server means the attacker may have had a route into maintenance systems; segmentation is a control, not proof. Review VPN authentication, session logs, and firewall rules for IT-to-OT traffic. Notify plant operations and safety leads immediately because recipe integrity affects product safety and quality. In communications, avoid saying 'OT was not affected' until logs confirm it. State that the company isolated IT systems and is validating OT controls. If recipe data was altered or exfiltrated, escalate to quality and regulatory teams because food safety records may be implicated.