Executive Summary

A well-established construction and design company with operations spanning multiple regional offices found itself at a crossroads after a devastating ransomware attack crippled its operations for over two weeks. The company had grown rapidly but its IT infrastructure had not kept pace — legacy systems, flat network topologies, and minimal security controls had created an environment ripe for exploitation.

HackersDigital was engaged to not only recover from the incident but to design and build an entirely new data centre from the ground up, implement enterprise-grade firewall infrastructure, deploy a zero-trust network architecture, and completely transform the company’s threat landscape. This case study details the full journey from crisis to a hardened, resilient infrastructure.

The Ransomware Incident

The attack originated through a phishing email received by a mid-level project coordinator. The email contained a macro-enabled document disguised as a subcontractor invoice. When opened, the macro executed a PowerShell-based dropper that downloaded the ransomware payload from an external command-and-control server.

Within 45 minutes, the malware had escalated privileges using a known Windows vulnerability, harvested domain credentials, and began encrypting file shares across the network. By the time the IT team recognised the issue, over 12TB of project data — including active construction blueprints, financial records, and client contracts — had been encrypted.

The ransom demand was significant, and the attackers threatened to leak sensitive client data. The company chose not to pay the ransom and instead engaged HackersDigital for full incident response and recovery.

Phase 1: Incident Containment & Forensic Analysis (Weeks 1–2)

Our incident response team was on-site within 4 hours of engagement. Immediate actions included:

• Network isolation — severed internet connectivity and segmented affected systems to prevent further lateral movement.
• Forensic imaging of compromised servers and workstations for evidence preservation and attack chain reconstruction.
• Identification of the ransomware variant, its indicators of compromise (IOCs), and the initial attack vector.
• Partial data recovery from offline backup tapes that had not been connected at the time of the attack.
• Stakeholder communication plan — drafted executive briefings and regulatory notification templates.

Phase 3: Firewall & Zero-Trust Network Implementation (Weeks 8–16)

The network was redesigned from the ground up following zero-trust principles — “never trust, always verify” — ensuring that no user, device, or application is inherently trusted regardless of its location.

• Next-generation firewalls (NGFW): Deployed enterprise-grade firewalls at the perimeter and between internal segments with deep packet inspection, SSL/TLS decryption, IPS, URL filtering, and threat intelligence feeds.
• Micro-segmentation: The network was divided into discrete security zones — Design/CAD, Engineering, Finance, Administration, Guest, and a DMZ for public-facing services. Inter-zone traffic is inspected and policy-controlled.
• Identity-based access: Implemented 802.1X network access control (NAC) so devices must authenticate before gaining network access. Unknown or non-compliant devices are quarantined automatically.
• Multi-factor authentication (MFA): Enforced MFA on all user accounts, VPN connections, and administrative interfaces. Eliminated single-factor password-only access across the organisation.
• Encrypted tunnels: Site-to-site VPN between offices with IPSec and always-on client VPN for remote workers, ensuring encrypted transport for all data in transit.
• DNS security: Deployed DNS filtering to block known malicious domains and prevent command-and-control callbacks, providing an additional layer of protection at the DNS resolution level.