Ransomware Attack: Lessons Learned
summary
A ransomware incident starts with one stolen remote desktop credential used for daytime reconnaissance on Thursday and Friday and full encryption launched Saturday; defenders stop spread within 30 minutes of Monday morning reports and restore from enterprise-grade backups, limiting data loss. Visibility gaps include cloud email and third‑party network device logs; investigators rely on internet scanners, honeypots and seized‑IP lists, rebuild domain controllers from recent backups, close all RDP and remote‑assistance, and plan more logs, tuned alerts and red/blue exercises.
AI-written summary · about
chapters (8)
- 0:00Intro
- 0:36Context
- 6:00Introduction
- 6:25Previous attacks
- 9:30How did they get in
- 10:37Lessons learned
- 14:03Reaction phase
- 18:45What we will do
related talks
41mRansomware Incident Response - The Real-World Story of a Ransomware Attack
32mSurviving a Ransomware Attack - Lessons from the Field
52mRansomware; The Real Pandemic
20mWhen ransomware strikes
38mRansomware and Backups: A Multi-Layered Defense Strategy
40mRansomware: New Recipe For An Old Dish
37mThe 2024 Ransomware Threat Landscape: What's Fueling the Epidemic?
52mRansomware 101: Get Smart Understanding Real Attacks