The vacation that wasn´t
Jun 10th, 2021 by Jesper Kråkhede
I had been looking forward to this vacation for months. Bags packed, plans made. Then the phone rang.
A service provider in northern Europe had been hit by ransomware, and not in a small way. More than 50 Active Directory forests, belonging to the provider and its customers, were lost. Encrypted or destroyed, all at once.
So the vacation was cancelled and I spent the following weeks helping to rebuild. I won´t go into details about the customer, but I can share some of what I learned.
The attackers had come in through the provider´s own environment and from there they had access to every customer, because the provider´s admin accounts and management tools reached everywhere. One identity, one set of tools, fifty victims.
Rebuilding one Active Directory after ransomware is a big job. Rebuilding fifty in parallel means you need a very clear order: which customers and which services come first, which domain controllers can be trusted, which backups are clean. And you need to make sure the attacker isn´t still there when you bring it back.
The technical lesson is the one I have repeated for years. A service provider´s admin environment is Tier 0 for every customer it serves. It needs to be protected like that, separated per customer and monitored closely.
I´ll take my vacation later. The attackers don´t check calendars.