Ransomware Incident Response - The Real-World Story of a Ransomware Attack
summary
Walkthrough of a CryLock incident where initial access comes from an RDP-exposed accountant box, escalates via RDP brute-force, and yields domain admin via a PSExec-backed backup script; attackers run short-lived automation to disable AV, pull tools from a web-host, and harvest credentials with mimikatz dumps; backups are encrypted because they sit on the same network (backup on same network); recovery uses an old migrated server plus two months of manual data reconstruction instead of paying a multi-million euro ransom.
AI-written summary · about
chapters (12)
- 0:00Introduction and welcome
- 1:31Ransomware landscape
- 4:15The ransomware incident
- 7:41Incident response challenges
- 10:56Recovery and business decisions
- 12:44Forensic analysis techniques
- 15:03Initial access demonstration
- 18:51Lateral movement and escalation
- 24:34The final payload delivery
- 28:52Attack simulation walkthrough
- 32:26Mitigation and best practices
- 35:17Q&A and closing remarks
related talks
21mRansomware Attack: Lessons Learned
32mSurviving a Ransomware Attack - Lessons from the Field
52mRansomware 101: Get Smart Understanding Real Attacks
20mWhen ransomware strikes
52mRansomware; The Real Pandemic
52mZero to Full Domain Administrator: Real-World Ransomware Incident
40mRansomware: New Recipe For An Old Dish
40mIncident Response – How to Give the Advantage to the Hackers!