Ransomware Containment for a UK Manufacturer

The Vulnerability: How the Attackers Got In

Hackers don’t break in; they log in. During the shift to remote work, the company had set up a Virtual Private Network (VPN) for their engineers. However, they failed to patch a critical software update on the VPN appliance.

Malicious actors scanned the internet, found the outdated VPN, and bypassed the login screen. Once inside, they began “lateral movement”—quietly jumping from server to server, planting their ransomware bomb across the network, waiting for the right moment to detonate it and demand millions in cryptocurrency.

The Execution: Stopping the Bleeding

The client contacted Logic Edge Security’s Incident Response team. We do not negotiate with terrorists; we cut them off. Our response was immediate and surgical:

1. Isolation & Containment: Within minutes, we severed the infected administrative subnets from the core network and the factory floor. We physically and digitally quarantined the blast radius.

2. Deploying Advanced Telemetry: We rapidly deployed Endpoint Detection and Response (EDR) sensors across all 300+ company devices. This acted like a digital radar, allowing us to see exactly where the attackers were hiding in real-time.

3. Threat Eradication: We identified the compromised administrator accounts the hackers were using and locked them out. We then hunted down the dormant ransomware files and purged them from the servers before the encryption could spread to the factory floor.