๐ Secure Bits ๐ก
๐ฅ๐ฒ๐ฎ๐น ๐ฅ๐ฎ๐ป๐๐ผ๐บ๐๐ฎ๐ฟ๐ฒ ๐๐ฎ๐๐ฒ ๐ฆ๐๐๐ฑ๐: ๐ฆ๐๐ฎ๐๐ฒ ๐ผ๐ณ ๐ก๐ฒ๐๐ฎ๐ฑ๐ฎ
I recently came across an excellent incident report from the State of Nevada about a ransomware attack โ a textbook case, but thankfully with a happy ending.
๐๐ฒ๐ฟ๐ฒ ๐ฎ๐ฟ๐ฒ ๐๐ผ๐บ๐ฒ ๐ธ๐ฒ๐ ๐น๐ฒ๐๐๐ผ๐ป๐ ๐ณ๐ฟ๐ผ๐บ ๐๐ต๐ฒ ๐ฟ๐ฒ๐ฝ๐ผ๐ฟ๐:
โธป
1๏ธโฃ ๐ง๐ต๐ฒ ๐ฎ๐๐๐ฎ๐ฐ๐ธ๐ฒ๐ฟ ๐๐ฎ๐ ๐ถ๐ป ๐๐ต๐ฒ ๐ฒ๐ป๐๐ถ๐ฟ๐ผ๐ป๐บ๐ฒ๐ป๐ ๐ณ๐ผ๐ฟ ๐ผ๐๐ฒ๐ฟ ๐ฏ ๐บ๐ผ๐ป๐๐ต๐
This is something I see often โ even longer periods of undetected access. Attackers arenโt just โwaitingโ โ theyโre actively mapping, moving, and escalating.
Thatโs why advanced auditing and SACLs on key AD objects are critical โ they help detect these early stages of compromise.
โธป
2๏ธโฃย ๐๐ป๐ถ๐๐ถ๐ฎ๐น ๐๐ฒ๐ฐ๐๐ผ๐ฟ: ๐๐บ๐ฝ๐น๐ผ๐๐ฒ๐ฒ ๐ฑ๐ผ๐๐ป๐น๐ผ๐ฎ๐ฑ๐ฒ๐ฑ ๐ฎ ๐บ๐ฎ๐น๐ถ๐ฐ๐ถ๐ผ๐๐ ๐ฎ๐ฑ๐บ๐ถ๐ป ๐๐ผ๐ผ๐น
Most likely on an admin workstation โ which allowed privilege escalation.
This is exactly why I keep pushing Tiering Models, LAPS, separate networks, and privilege separation. Proper segmentation would have likely contained the attack.
Attack surface down, detection window up.
โธป
3๏ธโฃ ๐๐ป๐๐ถ๐๐ถ๐ฟ๐๐/๐๐๐ฅ ๐๐ฎ๐ ๐ถ๐ป ๐ฝ๐น๐ฎ๐ฐ๐ฒ โ ๐ฎ๐ป๐ฑ ๐๐๐ถ๐น๐น ๐๐ฎ๐๐ปโ๐ ๐ฒ๐ป๐ผ๐๐ด๐ต
AV/EDR/XDR tools are valuable, but theyโre not silver bullets.
They can be bypassed โ and worse, ignored. If a threat is quarantined โ someone must investigate.
โธป
4๏ธโฃ ๐ก๐ผ ๐ฟ๐ฎ๐ป๐๐ผ๐บ ๐ฝ๐ฎ๐ถ๐ฑ โ ๐๐ต๐ฒ ๐๐๐ฎ๐๐ฒ ๐น๐ฒ๐ฑ ๐๐ต๐ฒ ๐ฟ๐ฒ๐ฐ๐ผ๐๐ฒ๐ฟ๐ ๐๐ถ๐๐ต ๐๐๐ฟ๐ผ๐ป๐ด ๐๐ฒ๐ป๐ฑ๐ผ๐ฟ ๐๐๐ฝ๐ฝ๐ผ๐ฟ๐
Internal teams put in thousands of overtime hours and kept ownership of decisions and institutional knowledge, while vendors provided specialized forensics and recovery support.
Smart move long-term: money went into resilience and hardening, not into an attackerโs wallet.
โธป
5๏ธโฃ ๐๐๐๐ถ๐ป๐ฒ๐๐-๐ฐ๐ฟ๐ถ๐๐ถ๐ฐ๐ฎ๐น ๐๐ฒ๐ฟ๐๐ถ๐ฐ๐ฒ๐ ๐๐ฒ๐ฟ๐ฒ ๐ฟ๐ฒ๐๐๐ผ๐ฟ๐ฒ๐ฑ ๐ถ๐ป ๐ณ ๐ฑ๐ฎ๐๐, ๐ณ๐๐น๐น ๐ฟ๐ฒ๐ฐ๐ผ๐๐ฒ๐ฟ๐ ๐ถ๐ป ๐ฎ๐ด ๐ฑ๐ฎ๐๐
Depending on the organization, that might seem quick โ or catastrophic.
Can your business afford 7 days of downtime? If not, time to prepare.
โธป
6๏ธโฃ ๐ง๐ต๐ฒ๐ ๐ฟ๐ฒ๐ฏ๐๐ถ๐น๐ ๐๐ฐ๐๐ถ๐๐ฒ ๐๐ถ๐ฟ๐ฒ๐ฐ๐๐ผ๐ฟ๐ ๐๐ถ๐๐ต ๐ง๐ถ๐ฒ๐ฟ๐ถ๐ป๐ด ๐ ๐ผ๐ฑ๐ฒ๐น ๐ฎ๐ป๐ฑ ๐๐๐ฃ๐ฆ
Exactly what I advocate for. Yes โ AD is still a massive attack surface, and yes โ itโs still often misconfigured.
This is not a rare case. Itโs common โ I see it every day.
โธป
๐ข ๐ฆ๐ต๐ผ๐๐๐ผ๐๐ to the State of Nevada for their transparent handling and for sharing such a valuable report. We all learn and improve from examples like this. ๐๐๐น๐น ๐ฟ๐ฒ๐ฝ๐ผ๐ฟ๐:
