Inside the Hacker's Playbook - How We Stopped a €20M Ransomware Payout

The talk follows an incident response case in which a CryLock ransomware attack halted an organization's operations on a Sunday morning. The attackers pressured the IT manager directly, and the response was hampered by gaps the speaker describes: an incident response plan stored on the encrypted server, no out-of-band communication channel, and backups on the same flat network as production.

The investigation rebuilt the timeline from scattered evidence. The first successful logon came seven months before encryption, followed by logons from VPN and Tor exit addresses and another about two weeks before the attack. The intruders worked in sessions of four to eight minutes, short enough to avoid endpoint protection re-enabling itself. Along the way the investigators found a file of passwords on an accountant's desktop, browser-stored credentials, local administrator rights, a nightly backup job running under a domain administrator account, and a sticky keys backdoor. Credential dumping and remote access led to the domain controller, and the speaker estimated roughly four hours from domain admin access to deployment. The talk also included a demonstration of the attack chain on real systems.

The organization avoided paying the ransom because a legacy server left over from a hardware migration still held a year-old copy of data, though rebuilding took about two and a half months and more than twenty analysts. The total cost was around one million euros. The takeaways are to rehearse response plans, keep out-of-band communications ready, isolate backups, enforce unique strong passwords with multi-factor authentication, limit admin rights, manage browser and endpoint settings, and make sure someone watches the alerts.