Ransomware Case Study

๐Ÿ”’ Secure Bits ๐Ÿ’ก
๐—ฅ๐—ฒ๐—ฎ๐—น ๐—ฅ๐—ฎ๐—ป๐˜€๐—ผ๐—บ๐˜„๐—ฎ๐—ฟ๐—ฒ ๐—–๐—ฎ๐˜€๐—ฒ ๐—ฆ๐˜๐˜‚๐—ฑ๐˜†: ๐—ฆ๐˜๐—ฎ๐˜๐—ฒ ๐—ผ๐—ณ ๐—ก๐—ฒ๐˜ƒ๐—ฎ๐—ฑ๐—ฎ
I recently came across an excellent incident report from the State of Nevada about a ransomware attack โ€” a textbook case, but thankfully with a happy ending.

๐—›๐—ฒ๐—ฟ๐—ฒ ๐—ฎ๐—ฟ๐—ฒ ๐˜€๐—ผ๐—บ๐—ฒ ๐—ธ๐—ฒ๐˜† ๐—น๐—ฒ๐˜€๐˜€๐—ผ๐—ป๐˜€ ๐—ณ๐—ฟ๐—ผ๐—บ ๐˜๐—ต๐—ฒ ๐—ฟ๐—ฒ๐—ฝ๐—ผ๐—ฟ๐˜:

โธป

1๏ธโƒฃ ๐—ง๐—ต๐—ฒ ๐—ฎ๐˜๐˜๐—ฎ๐—ฐ๐—ธ๐—ฒ๐—ฟ ๐˜„๐—ฎ๐˜€ ๐—ถ๐—ป ๐˜๐—ต๐—ฒ ๐—ฒ๐—ป๐˜ƒ๐—ถ๐—ฟ๐—ผ๐—ป๐—บ๐—ฒ๐—ป๐˜ ๐—ณ๐—ผ๐—ฟ ๐—ผ๐˜ƒ๐—ฒ๐—ฟ ๐Ÿฏ ๐—บ๐—ผ๐—ป๐˜๐—ต๐˜€
This is something I see often โ€” even longer periods of undetected access. Attackers arenโ€™t just โ€œwaitingโ€ โ€” theyโ€™re actively mapping, moving, and escalating.
Thatโ€™s why advanced auditing and SACLs on key AD objects are critical โ€” they help detect these early stages of compromise.

โธป

2๏ธโƒฃย ๐—œ๐—ป๐—ถ๐˜๐—ถ๐—ฎ๐—น ๐˜ƒ๐—ฒ๐—ฐ๐˜๐—ผ๐—ฟ: ๐—˜๐—บ๐—ฝ๐—น๐—ผ๐˜†๐—ฒ๐—ฒ ๐—ฑ๐—ผ๐˜„๐—ป๐—น๐—ผ๐—ฎ๐—ฑ๐—ฒ๐—ฑ ๐—ฎ ๐—บ๐—ฎ๐—น๐—ถ๐—ฐ๐—ถ๐—ผ๐˜‚๐˜€ ๐—ฎ๐—ฑ๐—บ๐—ถ๐—ป ๐˜๐—ผ๐—ผ๐—น
Most likely on an admin workstation โ€” which allowed privilege escalation.
This is exactly why I keep pushing Tiering Models, LAPS, separate networks, and privilege separation. Proper segmentation would have likely contained the attack.
Attack surface down, detection window up.

โธป

3๏ธโƒฃ ๐—”๐—ป๐˜๐—ถ๐˜ƒ๐—ถ๐—ฟ๐˜‚๐˜€/๐—˜๐——๐—ฅ ๐˜„๐—ฎ๐˜€ ๐—ถ๐—ป ๐—ฝ๐—น๐—ฎ๐—ฐ๐—ฒ โ€” ๐—ฎ๐—ป๐—ฑ ๐˜€๐˜๐—ถ๐—น๐—น ๐˜„๐—ฎ๐˜€๐—ปโ€™๐˜ ๐—ฒ๐—ป๐—ผ๐˜‚๐—ด๐—ต
AV/EDR/XDR tools are valuable, but theyโ€™re not silver bullets.
They can be bypassed โ€” and worse, ignored. If a threat is quarantined โ€” someone must investigate.

โธป

4๏ธโƒฃ ๐—ก๐—ผ ๐—ฟ๐—ฎ๐—ป๐˜€๐—ผ๐—บ ๐—ฝ๐—ฎ๐—ถ๐—ฑ โ€” ๐˜๐—ต๐—ฒ ๐˜€๐˜๐—ฎ๐˜๐—ฒ ๐—น๐—ฒ๐—ฑ ๐˜๐—ต๐—ฒ ๐—ฟ๐—ฒ๐—ฐ๐—ผ๐˜ƒ๐—ฒ๐—ฟ๐˜† ๐˜„๐—ถ๐˜๐—ต ๐˜€๐˜๐—ฟ๐—ผ๐—ป๐—ด ๐˜ƒ๐—ฒ๐—ป๐—ฑ๐—ผ๐—ฟ ๐˜€๐˜‚๐—ฝ๐—ฝ๐—ผ๐—ฟ๐˜
Internal teams put in thousands of overtime hours and kept ownership of decisions and institutional knowledge, while vendors provided specialized forensics and recovery support.
Smart move long-term: money went into resilience and hardening, not into an attackerโ€™s wallet.

โธป

5๏ธโƒฃ ๐—•๐˜‚๐˜€๐—ถ๐—ป๐—ฒ๐˜€๐˜€-๐—ฐ๐—ฟ๐—ถ๐˜๐—ถ๐—ฐ๐—ฎ๐—น ๐˜€๐—ฒ๐—ฟ๐˜ƒ๐—ถ๐—ฐ๐—ฒ๐˜€ ๐˜„๐—ฒ๐—ฟ๐—ฒ ๐—ฟ๐—ฒ๐˜€๐˜๐—ผ๐—ฟ๐—ฒ๐—ฑ ๐—ถ๐—ป ๐Ÿณ ๐—ฑ๐—ฎ๐˜†๐˜€, ๐—ณ๐˜‚๐—น๐—น ๐—ฟ๐—ฒ๐—ฐ๐—ผ๐˜ƒ๐—ฒ๐—ฟ๐˜† ๐—ถ๐—ป ๐Ÿฎ๐Ÿด ๐—ฑ๐—ฎ๐˜†๐˜€
Depending on the organization, that might seem quick โ€” or catastrophic.
Can your business afford 7 days of downtime? If not, time to prepare.

โธป

6๏ธโƒฃ ๐—ง๐—ต๐—ฒ๐˜† ๐—ฟ๐—ฒ๐—ฏ๐˜‚๐—ถ๐—น๐˜ ๐—”๐—ฐ๐˜๐—ถ๐˜ƒ๐—ฒ ๐——๐—ถ๐—ฟ๐—ฒ๐—ฐ๐˜๐—ผ๐—ฟ๐˜† ๐˜„๐—ถ๐˜๐—ต ๐—ง๐—ถ๐—ฒ๐—ฟ๐—ถ๐—ป๐—ด ๐— ๐—ผ๐—ฑ๐—ฒ๐—น ๐—ฎ๐—ป๐—ฑ ๐—Ÿ๐—”๐—ฃ๐—ฆ
Exactly what I advocate for. Yes โ€” AD is still a massive attack surface, and yes โ€” itโ€™s still often misconfigured.
This is not a rare case. Itโ€™s common โ€” I see it every day.

โธป

๐Ÿ“ข ๐—ฆ๐—ต๐—ผ๐˜‚๐˜๐—ผ๐˜‚๐˜ to the State of Nevada for their transparent handling and for sharing such a valuable report. We all learn and improve from examples like this. ๐—™๐˜‚๐—น๐—น ๐—ฟ๐—ฒ๐—ฝ๐—ผ๐—ฟ๐˜: