Case study
Ransomware to business as usual in 36 hours.
A critical infrastructure operator called us before dawn. Ransomware was encrypting its servers. All customer-facing services were fully available and stable 36 hours after that first call.
- The client calls. Encryption is already active.
- Formal engagement. EDR rollout begins on critical servers.
- No active encryption. Automatic isolation rules live.
- Public website back online.
- Most internal production restored.
- All customer-facing services stable.
- About 90% of production servers restored.
What happened
Before dawn, mid-encryption
A critical infrastructure operator called us before dawn. Ransomware was actively encrypting its servers and endpoints. There was no contract, and no endpoint detection and response (EDR) in place.
We started work immediately. We identified the ransomware family from its ransom note and prepared our response while the engagement was being formalized. EDR deployment began within minutes of formal access, critical servers first. We caught the ransomware encrypting live and turned its behavior into detections that isolate any matching host automatically. Active encryption stopped within hours.
We disabled the hijacked domain admin account and restored systems in business order: customer-facing services first, then databases, virtualization, identity and backup. No system went back into service without a clean scan, integrity checks and a health test. When one database restore stalled, we built a new server instead of waiting.
All customer-facing services were fully available and stable 36 hours after the first call. Most internal production was running within 28 hours. Workstation rebuilds continued after operations resumed.
How we did it
What made it fast
- We moved before the paperworkEvidence collection, malware triage, a decryptor search, a dark web credential check and EDR preparation were all underway before formal access was granted.
- EDR within minutes of accessRollout began six minutes after formal engagement, critical servers first.
- The live sample became containmentWe caught the ransomware encrypting live, extracted the sample and built behavior-based detections. Any matching host is isolated automatically, which takes human delay out of containment.
- Speed over forensics, on purposeOnce containment was proven, we deferred the root-cause analysis and put the effort into recovery.
- Business order, behind quality gatesCustomer-facing services first, then databases, virtualization, identity and backup. Nothing went back into service without a clean scan, integrity checks, an application health test and confirmed telemetry.
- Practical callsA database restore was 40% done after five hours, so we built a new server. Backups holding encrypted files were restored from an earlier point. An unrelated DNS registrar fault was set aside, not chased.
- A strong team on the other sideThe client’s IT team was calm, collaborative and decisive throughout.
What 36 hours means
Back up, defined
We start the clock at the client’s first call, not at the formal engagement hours later. It’s the longer number, and it’s the clock the client lived through.
- 28 hoursMost internal production systems running.
- 36 hoursEvery customer-facing service fully available and stable. The organization back at working capacity.
- 44 hoursAbout 90% of production servers restored.
- After thatDesktop and virtual desktop rebuilds continued for several days.
Industry-wide, only about half of ransomware victims fully recover within a week. Source: Sophos, State of Ransomware 2025. Sophos measures full recovery, a broader measure than the customer-facing services we count here.
Hour by hour
The timeline
Elapsed time from the client’s first call, approximate.
- The client calls. Encryption is already active.
- Our first incident response call. Preparation begins before the contract.
- Formal engagement. EDR rollout begins on critical servers.
- Live encryption caught. Host isolated, sample pulled.
- No active encryption. Automatic isolation rules live.
- Pivot to recovery. Root cause deferred.
- Full restoration starts, crown jewels first.
- Hijacked domain admin account disabled.
- Public website back online.
- Most internal production restored.
- All customer-facing services stable.
- About 90% of production servers restored.
Start here
The Leadership Second Opinion
No charge. No strings. It’s yours to keep, whether we work together or not.