Module 12 Lesson 5 of 6 🕑 ~45 min

> cat module-12-5-ransomware-case-study.md

Ransomware Deep Dive & Case Study

Everything from Lessons 1–4 — detection, investigation, containment, eradication, recovery, communications, regulatory pressure — converges in one scenario. This lesson follows a single fictional company through a complete ransomware incident, stage by stage.

1 Ransomware Is No Longer Just Encryption

Ransomware remains one of the best scenarios for teaching incident response because it touches almost every part of an organisation. Modern ransomware incidents typically combine encryption with data theft — the attacker threatens to publish stolen information even if the organisation can fully restore from backups, exactly the double-extortion pattern from Module 8's ransomware section. That means the incident is simultaneously a security incident, a privacy breach, a business continuity event, a legal event, and a reputational crisis, all at once and all needing a response. CISA's current ransomware guidance explicitly covers both ransomware and data-extortion scenarios, with separate prevention and response recommendations for each.

2 Case Study — GlobalCoffee Ltd

A fictional multinational: 18,000 employees across the UK, Germany, USA, India and Singapore, running Active Directory, Microsoft 365, Azure, AWS, VMware, Windows laptops, Linux servers, Oracle ERP, legacy manufacturing systems, VPN, EDR and a SIEM.

1. Initial Access — phishing steals VPN credentials, MFA fatigue approval↓ 2. Discovery — attacker maps file servers, AD, backups, admins↓ 3. Credential Access — exposed privileged credentials on one server↓ 4. Lateral Movement — backup-admin logs in from a finance workstation↓ 5. Data Theft — HR/customer data collected, large overnight transfers↓ 6. Backup Attack — attacker attempts to delete backup snapshots↓ 7. Ransomware Deployment — 04:20 UTC, mass encryption begins↓ 8. Detection — EDR flags mass file modification, SOC declares major incident↓ 9. Containment — isolate hosts, disable accounts, protect DCs and backups↓ 10. Investigation — compromise traced back 3 days, 63 systems affected↓ 11. Eradication — credentials reset, systems rebuilt, MFA strengthened↓ 12. Recovery — staged restoration over 5 days in a clean environment↓ 13. Lessons Learned — root causes identified, corrective projects created

Stage 1 – Initial Access

An employee receives a phishing email; the attacker steals VPN credentials. The organisation uses MFA, but the employee approves an unexpected authentication request — MFA fatigue (Module 9, Lesson 2) in action. The attacker successfully connects to the corporate VPN.

Stage 2 – Discovery

The attacker investigates the environment, identifying file servers, Active Directory, backup infrastructure, virtualisation servers, and administrator accounts — the MITRE ATT&CK Discovery tactic (Module 11, Lesson 2) at work.

Stage 3 – Credential Access

The attacker compromises a server where privileged credentials happen to be exposed, obtaining administrator access.

Stage 4 – Lateral Movement

The attacker moves between systems. Security logs show:

Account: backup-admin
Source: WS-FINANCE-044
Target: SRV-BACKUP-01
Logon Type: Remote
Time: 02:43 UTC

The backup administrator account should never normally log in from a finance workstation — exactly the kind of anomaly-based signal Module 11 (Lesson 2) covers, and an important detection opportunity that, in this scenario, gets missed at the time.

Stage 5 – Data Theft

The attacker collects HR and customer information; large outbound transfers occur overnight, while activity is at its lowest and least likely to be watched closely.

Stage 6 – Backup Attack

The attacker attempts to delete backup snapshots — a deliberate move to remove the organisation's ability to recover without paying (Module 12, Lesson 2's backup-compromise concern).

Stage 7 – Ransomware Deployment

At 04:20 UTC, ransomware begins deploying across Windows systems. Within minutes, file servers and ERP are unavailable, employee laptops are encrypted, and manufacturing systems are affected. A ransom note appears.

Stage 8 – Detection

EDR generates a CRITICAL alert: mass file modification on SRV-FILE-23, an unknown process rapidly modifying 18,421 files. The SOC declares a major incident.

Stage 9 – Containment

Responders isolate infected hosts, disable compromised accounts, protect Domain Controllers, restrict lateral movement, isolate backup systems, block attacker infrastructure, revoke VPN and cloud sessions, and begin an enterprise-wide threat hunt — the full containment playbook from Lesson 2, applied under pressure.

Stage 10 – Investigation

Forensic analysts discover the initial VPN compromise happened three days earlier; roughly 63 systems show attacker activity; two administrator accounts were compromised; data was probably exfiltrated; backup infrastructure was accessed; cloud systems show no compromise. The incident existed far longer than the visible ransomware encryption — extremely common in practice. The encryption event is usually just the final, loudest stage of a much longer compromise, not the whole story.

Stage 11 – Eradication

The organisation resets privileged credentials, rebuilds compromised systems, removes persistence, patches exposed services, reconfigures VPN access, strengthens MFA, removes compromised tools, rotates service credentials, and reviews domain privileges — root-cause eradication (Lesson 2), not just malware removal.

Stage 12 – Recovery

The company builds a clean recovery environment and brings systems back gradually: Day 1 identity and DNS, Day 2 critical databases, Day 3 ERP, Day 4 customer systems, Day 5 employee services, remaining infrastructure over the following weeks — the staged, dependency-aware recovery from Lesson 2.

Stage 13 – Lessons Learned

Investigation identifies several failures: legacy MFA allowed approval-based attacks, privileged credentials were reused, network segmentation was weak, backup administration shared Active Directory identities with everything else, several servers lacked EDR, and VPN logging retention was insufficient. Projects get created to correct each weakness — that's how a real incident is supposed to improve the organisation, not just end when the systems come back online.

3 Translating Findings Into an Executive Summary

Technical accuracy alone isn't enough — the findings have to reach an executive audience in language they can actually act on.

🔮 Predict first

Here's a technically accurate summary: "PowerShell spawned from Word and created IOC matches followed by SMB lateral movement and EDR telemetry showing T1486." What's wrong with sending this to the CEO, and how would you rewrite it?

Reveal a better version

Most executives won't parse "T1486" or "IOC matches" — the summary needs to convey scope and business impact in plain language instead:

GlobalCoffee International identified a ransomware attack affecting part of its Windows environment. Initial investigation indicates that an employee account was compromised before the attacker obtained elevated privileges and moved between internal systems. Several file servers have been encrypted and are currently isolated. There is evidence that the attacker may also have transferred company data externally; investigation into the affected information is continuing. The incident-response team has isolated known compromised systems, disabled affected accounts and protected backup infrastructure. Critical services are being restored using validated backups in a controlled recovery environment.

Both technical precision and this kind of plain-language translation are genuine, separate skills an incident responder needs — and being able to write the second version from the first is exactly what a strong Incident Commander (Lesson hub, Section 4) does when briefing upward.

Lesson Outcome

You should now be able to explain why modern ransomware is a data-theft crisis as much as an encryption one, trace a full ransomware incident through all thirteen stages and recognise which lesson each stage draws on, and translate technical findings into an executive summary that leads with known facts, suspected facts, and clearly separates the two. Lesson 6 puts you in the response seat yourself, with a 10-inject live simulation exercise.