Widespread encryption in about 20 minutes. Critical operations back in 5 days. No ransom paid.
A technology company in India was hit through a known VPN flaw that had gone unpatched for months. Once inside, ransomware spread across servers, workstations and every connected backup in about 20 minutes.
Client overview
Technology and IT Services
A mid-sized technology and IT services company operating from two office locations.
Technologies used
The problem
An unpatched VPN left the door open. Once inside, they encrypted the network in about 20 minutes.
A known vulnerability in the company’s SSL VPN had gone unpatched for months. The client’s in-house IT team looked after patching. Attackers exploited the flaw, moved directly to Active Directory and stole credentials. Admin passwords were stored in a plain-text file on an IT admin’s desktop.
Within about 20 minutes of gaining access, ransomware had spread across the servers, the workstations and every connected backup. The entire business came to a standstill. Uniware was brought in to lead the recovery.
The solution
Full recovery in three weeks, built on five stages.
Uniware responded immediately, following the NIST Cybersecurity Framework end-to-end. The five stages overlapped rather than running one after another, with protection and monitoring added as systems were rebuilt.
- 1IdentifyWe scoped the damage before restoring anything: which systems were encrypted, which accounts were compromised, and how the attackers got in through the VPN. Nothing was restored until the way in was understood.
- 2ProtectThe VPN was patched and Active Directory was rebuilt with hardened configuration and MFA. Plain-text credential storage was removed, and the flat network was split into segments to limit how far an attack can spread.
- 3DetectEndpoint detection and response (EDR) was deployed across servers and workstations, replacing traditional antivirus. It scanned for any remaining attacker activity and now alerts the team to suspicious behaviour.
- 4RespondInfected systems were isolated and compromised accounts disabled. Attacker access through the VPN and perimeter was blocked, critical servers were separated from the network, and logs and forensic evidence were preserved.
- 5RecoverCritical operations were restored in 5 days from offline backup copies the attackers could not reach. The full environment was rebuilt in 3 weeks. Backups are now kept offline or immutable, so no single attack can reach every copy.
Technologies used
Before and after
Where the business was, and where it is now.
| Metric | Before | After |
|---|---|---|
| VPN security | Known flaw left unpatched for months | Patched, with MFA on remote access |
| Credential management | Admin passwords in a plain-text file | Active Directory rebuilt, hardened, MFA enforced |
| Backup status | Connected copies encrypted with everything else | Offline and immutable copies kept out of reach |
| Network segmentation | Flat, so one breach reached everything | Segmented to contain a breach |
| Endpoint protection | Traditional antivirus | EDR across servers and workstations |
| Monitoring | Limited alerting | Continuous monitoring and alerts |
The results
Critical operations in 5 days. Fully recovered in 3 weeks. No ransom paid.
- Critical operations restored in 5 days from offline backups the attackers could not reach
- Full environment recovered in 3 weeks
- No ransom paid
- Ongoing managed security service agreement signed after recovery
- Zero repeat incidents since recovery
A quote from our team
Don’t assume backups alone will save you. Make sure they are isolated, turn on MFA everywhere, patch internet-facing systems quickly, and test your recovery.
Dhanasekar
Chief Technology Officer, Uniware Systems
Facing something similar?
Talk to the Uniware team about ransomware recovery and prevention, before an attack forces the conversation.
Book a Security Review