Counter-Ransomware (C-RW™)

The owner and CEO of a successful boutique headhunting business called us after a ransomware demand appeared on his employees’ screens. He was outraged and frightened: losing his records containing over 20 years of knowledge would destroy his company, put over forty people out of a job and risk prosecution for failing to protect clients’ personal data. Fortunately for him, an Othrys director and a senior cyber expert were round the corner with another client. Having instructed him on immediate steps to contain the threat temporarily, we were quickly onsite to make an assessment and advise on how best to manage the crisis.

We discovered that the company IT systems and procedures were generally robust, but a weak password policy had allowed an opportunistic criminal to gain access and launch the attack. As our client had reacted immediately, we were able to prevent the ransomware from infecting the back-up system and therefore a system flush and cleanse, followed by a restoration from back-up, had them up and running the same day with only an hour or so of lost data. A post-incident workshop resulted in improvements to the user access controls (including a better password policy) and the establishment of a clear and comprehensive crisis management plan. Our client was lucky: the attacker was opportunistic, impetuous and not technically very competent. But as a result of the incident, he put his house in order, which ensured resilience against more sophisticated attacks.

The finance director of a medium-sized logistics company, which had spent three days attempting to manage a ransomware attack that had closed down the entire operation, was referred to Othrys by another client. An Othrys director quickly assessed the situation and found that a leading cyber security company had already made an effective diagnosis of a carefully planned and executed attack, and established that it could not be reversed without the unlock codes. However the negotiation with the ransom gang, which appeared to know everything about the company and had the upper hand, had been poorly handled. The clock had been run down almost to the deadline, a third-generation family business of over 800 employees was facing potential bankruptcy and the company’s leaders were traumatised and exhausted. They had concluded that they had no alternative but to pay the high cryptocurrency ransom but had no idea how, or even whether it was legal to do so.

Our ransomware experts provided crisis management, legal advice and specialist support in handling cryptocurrency payments, much of it over a weekend, to reach a negotiated agreement with the criminals and transfer the ransom. The company received the unlock codes a few hours later, recovered their systems and most of their vital data, and were back in business early enough to avoid bankruptcy.