Don't leave remote desktop open
RDP exposed to the internet is one of the most common ways ransomware gets in. Put it behind a VPN, or switch it off.
Client stories / Ransomware
Ransomware, caught in the act.
A large UK online retailer was hit by ransomware. When I connected to their server, the attackers were still on it. Here's how we stopped the encryption, recovered everything without paying a ransom, and how close it came to being far worse.
- Client
- Large UK online retailer, high-end interiors
- Incident
- Ransomware on the office and web servers
- Ransom paid
- None
- Data recovered
- All of it, from backup
01What happened
The website broke, then the files locked
The first signs were a website that wasn't working properly and files on the office shared drives that had been encrypted.
The attackers had broken into both the office server and the web server, most likely through remote desktop (RDP) left open to the internet and a server and router that hadn't been patched. Neither server was running endpoint protection.
When I connected to the server to start work, the attackers were connected too. They were still inside, while the encryption was running.
02Response
How I responded
- 01
Shut the door
First I locked down external access, which kicked the attackers out of the network and stopped them coming back in.
- 02
Stopped the encryption
Then I stopped and removed the ransomware before it finished, while there were still backups it hadn't reached.
- 03
Wrote it up
The retailer's lawyers and insurer were involved, so once everything was secure I wrote the incident report: what happened, how, and what was accessed.
- 04
Restored and rebuilt
Everything came back from backup, but slowly. Thousands of product images had to be renamed and reformatted to move from the recovery environment to the live site, and permissions had to be rebuilt.
03Outcome
Nothing lost for good, but it wasn't cheap
No ransom was paid and no data was lost. But the website was down for at least a week, the full recovery took a good couple of weeks, and the cost of downtime, lost sales, legal fees and incident response added up fast.
04Near miss
It was closer than it looked
The backup system was connected to the same server the attackers were on. A little longer, and they could easily have deleted or encrypted the backups too. Then there would have been nothing to restore.
Afterwards I installed endpoint protection on both servers and every office computer.
05Lessons
What your business can take from this
Patch servers and routers
Unpatched kit at the edge of your network is an open invitation. Updates are dull, and that's the point.
Cyber Essentials covers thisKeep a backup they can't reach
If your backups are connected to the systems being attacked, they can be wiped too. Keep a copy offline or locked against changes, and test it.
Testing your backupsProtect servers, not just laptops
Endpoint protection belongs on every server too, where it can spot and stop ransomware before it spreads.
If ransomware hitsNext story: The forgotten laptop that played the music.
Files locked, or not sure?
Treat it as an emergency. Response usually starts remotely within the hour, with a fixed £795 first response.