Anatomy of a Ransomware Attack Response

Client profile

Place FalconX is a prominent Silicon Valley-based accelerator, nurturing over 100 startups with innovative ideas and disruptive technologies. With a reputation for fostering entrepreneurial success, Place FalconX is at the forefront of driving innovation in the tech industry.

Background & Context

In the early hours of a weekend, Place FalconX faced a daunting challenge: a Ransomware Attack targeting its critical infrastructure. This case study details the collaborative efforts between Place FalconX and Opsara, a trusted cybersecurity firm, in navigating through the crisis. The response unfolded across five key phases:

  • Confirm & Contain
  • Investigation
  • Analysis
  • Manage and Restore
  • Future Improvements

Background & Context

Attacked Organization Profile

(Modern to protect identify)

  • Global manufacturing company.
  • 1,000 employees in US and globally 20,000+.
  • Distributed operations with over 10 locations in US.
  • Enterprise scale IT infrastructure includes
    • Private Cloud and Public Cloud
    • US IT infra team
    • US App Dev team
    • Overseas parent IT HQ & Global SOC
    • Yearly compliances audits

 

 

Opsara relationship

  • Engaged few months prior to incident
  • Initial scope:
    • Advisory role to CIO & IT team
    • Operational support
    • Lead critical upgrade projects

 

 

Manage services

Security services

Hyper converged global platform

Manage Noc

Phase 0: Confirm & Contain

Zero Hour :

At 4:30 am, the Chief Information Officer (CIO) of Place FalconX received a distressing notification, signaling the onset of the crisis. With Opsara and key internal stakeholders mobilized, immediate action was imperative.

+2 Hours:

Recognizing the urgency, Opsara swiftly engaged experts and made critical decisions. An incident bridge was established to facilitate coordination, while Incident Response Specialists and specialist legal firms were enlisted to combat the threat. Senior management was briefed, and proactive measures such as disconnecting internet egress connectivity were implemented to contain the attack.

+6 Hours:

As dawn approached, Place FalconX and Opsara embarked on the investigative phase. Legal and forensic planning took precedence, with budgets allocated and contracts signed with experts. Communication plans were devised for internal and external stakeholders, ensuring transparency and accountability. Core teams were assembled, and secure communication channels were established to safeguard sensitive information.

Assemble core experienced team

Investigate

Hours 6 to 24:

With the foundation laid, Place FalconX and Opsara expanded their efforts, setting up an extended team comprising program management, forensics, remediation experts, and legal counsel. Fact-finding meetings were initiated, fostering collaboration and information sharing. Decisions were made regarding forensic agent deployment, network services, and server shutdowns. Legal counsel played a pivotal role in mitigating legal exposure and liaising with law enforcement agencies.

Coordination between the groups is critical

Analyze

Day 2 to 7

As the investigation progressed, data analysis became paramount to understand the scope and impact of the attack, laying the groundwork for future improvements.

Manage & restore

Week 2 to 6

With the threat contained, efforts shifted towards managing the aftermath and restoring normal operations. Priorities were set for Business As Usual (BAU) restoration, including establishing backup workflows, network isolation, and endpoint scanning. Missing backups were identified, and plans were devised for their reconstruction. Ongoing assessments ensured alignment with legal, forensic, and business needs, with clear communication maintained at all levels.

Balance legal, forensics & business needs

Improvement - "Life after the Attack"

Life after the Attack

In the aftermath of the ransomware attack, Place FalconX embarked on a journey of enhancement and fortification to ensure a resilient security posture for the future. Under the initiative titled “Life after the Attack,” the organization initiated a comprehensive reorganization of its security infrastructure and practices:

  • Re-org of Security Posture Initiated.
  • Architecture Simplification Prioritized.
  • Periodic Testing & Monitoring of Backups Initiated.
  • Network Controls Revisited.
  • Annual Red Team Assessment Proposed.
  • Network Controls Revisited.
Balance legal, forensics & business needs

Conclusion

The ransomware attack on Place FalconX underscored the importance of preparedness and collaboration in combating cyber threats. Through the concerted efforts of Place FalconX and Opsara, the organization emerged stronger and more resilient, equipped with valuable insights to bolster its cybersecurity posture. As technology continues to evolve, the partnership between Place FalconX and Opsara serves as a beacon of proactive cybersecurity practices in an increasingly digital world.