From Ransomware to Resilience
The morning began with a routine question: why had several servers powered off overnight? For a U.S.-based document and records management company, those systems supported services its customers relied on every day.
Within minutes, the Sparkfire Solutions response team realized this was not a technical glitch. An attacker had entered the network, deployed ransomware, and was still active inside it. The next few hours would determine how much damage the business experienced.
At a Glance
The response moved quickly from discovery to containment, recovery, and long-term security improvements.
-
Attacker access was cut off within minutes.
-
Full containment took approximately three hours.
-
The core customer application returned the same day.
-
No customer application data was lost.
-
Every technical change included documentation and rollback steps.
Step 1: Stop the Attack
Our first priority was removing the attacker and preventing further access. We closed active sessions, disabled the compromised account, blocked remote access, and isolated affected systems. The entry point was traced to outdated firewall test settings that allowed remote access without a second verification step. We removed the vulnerable configuration, disabled the guest account involved, changed firewall credentials, and restored remote access with multi-factor authentication required for every login. This follows the immediate isolation approach recommended in CISA’s StopRansomware Guide.
Step 2: Understand the Damage
Once the intrusion was contained, we examined each server to determine what had been affected. Systems that were running during the attack, including the primary databases and identity services, had not been encrypted. We also preserved affected systems, logs, and records without deleting or altering evidence, allowing the client’s insurer and specialist investigators to continue their work properly.
Step 3: Restore Critical Operations
The client’s highest priority was the application its customers used every day. We confirmed that its database was intact and current through the end of the previous business day, created a verified backup, and rebuilt the application on a clean server. It returned online that evening with no data lost. During the following days, we restored portal access, kept public websites available, and resolved issues as they appeared.
Step 4: Secure Every Account
Because ransomware attacks often rely on stolen credentials, we treated every identity as a potential risk. Administrator passwords were reset, staff selected new credentials, and a hidden administrator account left by an earlier attacker was found and disabled. We removed obsolete accounts, restricted administrative access to a small named group, enabled multi-factor authentication for cloud administrators, reviewed outside access, and created separate secure accounts for emergencies and investigators.
Step 5: Harden Remote Access
The firewall was rebuilt around least-privilege access. Remote connections are now limited to approved staff in the United States, every login requires multi-factor authentication, idle sessions expire automatically, and repeated password attempts are blocked for longer periods. Old rules that unnecessarily exposed servers to the internet were removed. The change immediately stopped constant overseas password-guessing attempts from reaching the company’s systems.
Step 6: Remove Single Points of Failure
The attack revealed that too much depended on the office network. We built two new identity servers in Microsoft Azure, placed them in separate locations, and moved critical network roles to the cloud. Cloud servers were reconfigured so they could operate without the office, stale systems were removed from network records, and protected cloud backups were created. Microsoft also recommends isolated backups and recovery environments as part of its ransomware protection guidance.
Step 7: Keep Watching
Recovery continued long after the main application returned. We introduced daily security checks, including weekends, covering new accounts, administrative changes, failed logins, and unusual remote access. Security protection was verified across every cloud server, log retention increased from 90 days to two years, and alerts were added for operational risks such as low disk space. Every change was documented with its purpose and reversal process.
What Changed for the Client
The company did not simply return to its previous state. It returned with stronger controls and a more resilient environment.
-
All remote access now requires multi-factor authentication.
-
Administrator rights are limited to named users.
-
Cloud systems can continue operating if the office goes offline.
-
Protected backups improve recovery options.
-
Longer log retention strengthens future investigations.
-
Daily monitoring helps surface problems earlier.
Lessons for Every Business
The first hours of a ransomware incident matter, but preparation determines how many recovery options a business has. Strong identity security, protected backups, useful logs, limited administrator access, and a tested response plan can reduce both downtime and uncertainty.
-
Require multi-factor authentication for remote and administrator access.
-
Remove temporary settings and test accounts after projects end.
-
Keep administrator rights to an absolute minimum.
-
Maintain at least one backup that attackers cannot easily delete.
-
Retain logs long enough to support an investigation.
-
Know who to contact and what to do before an incident occurs.
From Incident to Resilience
This incident began with powered-off servers and an attacker still inside the network. It ended with the core application restored the same day, no customer data lost, the entry point closed, identities secured, and a stronger cloud architecture in place.
At sparkfire.us, we help businesses build and operate secure, reliable technology environments, and we respond when critical systems fail. Our work combines Sparkfire software, Sparkfire automation, cloud engineering, security, and practical recovery planning. Explore more Sparkfire solutions and client case studies.
FAQs
What is ransomware incident response?
It is the process of containing an attack, preserving evidence, and restoring systems safely.
Why is multi-factor authentication important?
It prevents a stolen password from being enough to access a system.
Why should affected systems be preserved?
Preserved evidence helps insurers and investigators determine what happened.
What makes a backup ransomware-resistant?
Isolation, restricted access, immutability, and tested restoration procedures.
How can cloud infrastructure improve resilience?
It can remove single points of failure and provide stronger recovery options.
