Ransomware attack
ISSUE One client approached us to mitigate and find a solution for the Ransomware attack affecting their files in one of their critical department. They were using Kaspersky Antivirus as their endpoint protection which could not detect the Ransomware. INVESTIGATION The malware managed to get into one of the user’s Laptop who was getting remote support from a vendor using Anydesk. This tool allows transfer of files between two computers and it was not licensed version hence with no protection at all posing major security breaches. Local IT was not involved in this shadow IT support from a known application vendor. SOLUTION immediate isolation of the affected department and file server hosting their files. removed the Kaspersky Antivirus as it was adding a double protection layer on top of existing Windows defender which had a Ransomware Protection with Controlled folder access turned OFF cleaned all affected machines with Malwarebytes software deleted all affected folder shares on...