Note: All identifying details in this case study have been changed to protect the organisation identity. The technical details are accurate.
It was a Tuesday morning when we received the call. The IT manager of a mid-sized financial services firm in Nairobi had noticed that files on the company's shared drive were being renamed with an unknown extension. By the time he called us at 9:14 AM, roughly 30% of the shared drive was already encrypted.
What followed was a controlled, methodical incident response that resulted in full containment of the ransomware within three hours of first contact, preventing further encryption and enabling recovery to begin.
Attack Timeline
AM
AM
AM
AM
vssadmin delete shadows /all /quiet to prevent local recovery. File encryption begins simultaneously across 3 workstations. Files renamed with .enc2024 extension.AM
AM
AM
AM
AM
12:02 PM
PM
Phase 1: Triage and Initial Containment (9:14 — 9:47 AM)
Our first priority upon receiving the call was to stop the spread. Ransomware moves fast, and every minute of delay means more encrypted files.
Our remote triage team immediately began assessing the network while providing the IT manager with immediate containment instructions:
- Disconnect affected workstations from the network (physically unplug, don't just disable WiFi)
- Do not shut down affected systems — preserve volatile memory for forensics
- Identify and isolate the primary file server
- Prevent new logins to the domain until we understood the scope
Within 15 minutes, we had remote access to a clean management workstation and began analysing event logs. We identified the initial infection vector: a phishing email opened by an accounts payable staff member at 7:52 AM — over an hour before anyone noticed anything was wrong.
Phase 2: Identification and Scoping (9:47 — 10:31 AM)
We identified the ransomware variant as a modified version of a well-known strain, delivered via a macro-enabled Excel attachment in a spear-phishing email. The email had been highly targeted — it appeared to come from one of the firm's actual suppliers, complete with accurate invoice formatting.
The scope assessment revealed:
- 3 workstations fully encrypted
- 2 workstations partially encrypted
- 1 file server with 47% of data encrypted
- We found no immediate indicators of data exfiltration during the investigation.
- Backup systems were intact — the ransomware had not reached the offline backup storage
Phase 3: Eradication and Recovery (10:31 AM — 12:02 PM)
With backups confirmed intact, recovery was methodical. We initiated system rebuilds for the affected workstations and began restoring the file server from the most recent clean backup. Restoration completed later that day.
We also conducted a full credential reset for all domain accounts as a precautionary measure, given that the ransomware had domain-level access during its activity period.
Indicators of Compromise (IOCs)
The following IOCs were extracted during forensic analysis and shared with the client for integration into their detection tools and email filtering rules. Organisations running similar environments should check for these indicators immediately.
| Type | Indicator | Description | Severity |
|---|---|---|---|
| SHA-256 | a3f9c2e1b47d08f5 6c91e4b2d73a0f88 d5e2c1b9a4f70e3d |
Ransomware payload binary dropped by VBA macro. Detected as Ransom.Win32.Enc2024 | Critical |
| SHA-256 | 7b2d4e9f1c6a08b3 5e7d2f4a1c9b6e3f 8d5a2c7b4e1f9d6a |
VBA macro dropper embedded in Excel attachment (Invoice_Oct2024.xlsm) | Critical |
| Domain | update-srv-cdn[.]net | C2 server used for payload delivery. Registered 6 days before the attack. Hosted on bulletproof infrastructure. | Critical |
| Domain | supplier-invoice-portal[.]com | Spoofed domain used in phishing email. Visually similar to legitimate supplier domain. Registered via anonymous registrar. | High |
| IP Address | 185.220.101[.]47 | C2 callback IP. Associated with Tor exit node infrastructure. Seen in multiple ransomware campaigns across East Africa in Q4 2024. | Critical |
| IP Address | 91.108.4[.]203 | Secondary exfiltration check-in IP. No data exfiltration confirmed, but connection attempt logged. | High |
| File Path | C:\Users\Public\ svchost32.exe |
Ransomware binary dropped to public directory masquerading as a Windows system process. Persistence via scheduled task. | Critical |
| File Path | C:\Windows\Temp\ ps_drop_01.ps1 |
PowerShell dropper script. Executes encoded payload download. Deletes itself after execution. | Critical |
| Registry | HKCU\Software\ Microsoft\Windows\ CurrentVersion\Run \SvcUpdate32 |
Registry persistence key created by ransomware to survive reboots. Value points to dropped binary in Public folder. | High |
| MD5 | f3c9a1e2b4d7085f 6c91e4b2d73a0f88 |
Email attachment hash. Subject line: "Outstanding Invoice — Action Required". Sender spoofed as supplier@[legitimate-domain] | High |
Lessons Learned
What Saved This Client
- Offline backups — The single most important factor. Without them, recovery would have required paying the ransom or accepting total data loss.
- Fast response — Each minute of action taken after the call prevented additional file encryption.
- No panic — The IT manager followed our instructions precisely. Panicked responses (like shutting down servers) often destroy forensic evidence needed for recovery.
What This Client Needed to Improve
- Email filtering — the phishing email should have been caught before reaching the inbox
- Macro policies — Office macros should be disabled by policy for most users
- User training — staff needed phishing awareness training
- Network segmentation — the ransomware spread too easily between systems
- Monitoring — 82 minutes of undetected activity is far too long