Key facts
- Organisation
- Industrial manufacturer, Malaysia
- Threat
- Ransomware built from the publicly leaked LockBit 3.0 builder
- Initial access
- A remote-access tool configured for unattended access with a saved password
- Impact
- Almost 50,000 files encrypted on one workstation, and the purchasing folder on a branch file server encrypted over a mapped drive
- Core issue
- A shared standard account and a saved unattended-access password, with no multi-factor authentication anywhere on the remote-access path
What this case shows
- Even without direct internet exposure, a server can undergo encryption by leveraging the mapped network drives accessible to a compromised workstation.
- Unattended remote access converts one leaked password into a direct route from the internet to the desktop, bypassing the firewall entirely.
- Endpoint protection that stops running is worse than endpoint protection that fails to detect, as it generates no alert to signal the failure.
- When perimeter logs sit with a managed provider, the organisation cannot answer the data-theft question on its own evidence.
If remote access into your environment is not covered by multi-factor authentication, start with a compromise assessment or talk to us about incident response preparation.
What this would have cost with Blackpanda IR-1 in place
| ODIR | IR-1 | |
|---|---|---|
| Type of engagement | On-demand incident response | Yearly subscription |
| Hours covered | 50 hours | Unlimited* |
| Pricing1 | USD $25,000 | USD $2,500 |
* Unlimited for one incident per year
1 Ad-hoc incident response pricing based on average market rates, from USD 500 per hour. Blackpanda IR-1 subscription pricing based on no. of endpoints, costing approx. 10x less than ad-hoc and retainer-based incident response. All figures are illustrative only, for guidance and marketing purposes and not to be relied upon by the reader. Actual incident response costs vary by scope, complexity, and provider.
CHALLENGE
The organisation runs manufacturing operations across more than one site, and the file server at its branch plant holds the purchasing and supplier records for that division. Remote support reached the branch through a commercial remote-desktop tool installed on a workstation and configured for unattended access, meaning a saved password admitted a connection without anyone at the machine approving it. Several conditions compounded that exposure: one shared standard account was in use across multiple workstations and servers; the remote-access service on the site firewall was published to the internet with no multi-factor authentication on any account; and the branch backup jobs had been failing daily for roughly two months.
In July 2026, a threat actor authenticated against that saved password from an address in China and disconnected in under 10 seconds, without touching a file or running a command. The pattern is consistent with validation of a credential obtained elsewhere. How the password came to be known was never established from the available evidence. Days afterwards the encryptor was written to the workstation desktop, into a folder of installers dating back more than a decade, where it sat without running. Although the delivery route was tested against browser history, remote-session file transfers and removable-media records, none of them accounted for it.
Just over a week after the password test, in August 2026, the adversary connected again, this time from a rented cloud host. The endpoint anti-virus recorded an application-stopped event within three minutes, ceasing protection on the host for over twenty-four hours. The encryptor ran during that window; the remote session closed less than five minutes after it opened, while the encryption continued unattended. Almost 50,000 files were encrypted on the workstation, alongside almost 10,000 copies of the ransom note, and the process followed an existing mapped network drive onto the branch file server, where it encrypted the purchasing folder using the workstation's own permissions. The operating system's built-in anti-virus, which initialised once the primary product stopped, quarantined the process a little more than half an hour after encryption began.
Staff at the branch discovered the encryption several days later, when files in the purchasing folder would not open. By then the backups that would ordinarily have supported recovery had been failing for roughly two months, and the perimeter firewall and remote-access logs, which sit with a third-party managed provider, lay outside the organisation's control.
SOLUTION
1. Reconstructed the intrusion from host evidence rather than perimeter data
Because the perimeter firewall and remote-access logs were held by a third-party managed provider and were not produced during the engagement, the timeline was built entirely from endpoint artefacts: the remote-access service log, master file table timestamps, anti-virus event logs and the file server's security log. Blackpanda requested the missing records formally through the provider and recorded their absence as a stated limitation of the investigation, rather than inferring around the gap.
2. Identified the initial access vector and excluded the obvious alternative
The remote-access service on the site firewall, reachable from the internet with no second authentication factor, is the exposure most teams would have assumed. However, the remote-access tool on the workstation recorded both sessions in full, including authentication against the unattended-access profile, and that tool reaches the machine through its own relay infrastructure without traversing the firewall at all. Consequently the firewall exposure, serious as it is, was excluded as the entry path for this incident.
3. Tested the credential-exposure question against the evidence instead of inferring it
Scans across the workstation for infostealers, keyloggers and credential-theft tooling returned nothing, and the remote-access tool stores the unattended-access password only as a salted hash, from which the plaintext cannot be recovered. Blackpanda's assessment, held with medium confidence, is that the exposure is best explained by a weak, reused or previously shared password, consistent with the estate-wide use of a single shared standard account. The exposure route itself remains unresolved: confirming it would require management-console history that falls outside the collected evidence.
4. Bounded the compromise and scoped eradication accordingly
Encryption was traced to one workstation and one folder on one server, with no evidence of execution anywhere else in the environment, and no persistence mechanism of any kind: no attacker-created service, scheduled task, backdoor account, run key or cleared log. Because the adversary nonetheless held interactive control of the workstation for several minutes, eradication was scoped to a full rebuild from a known-good source rather than removal of the identified artefacts, since cleaning alone could not return the machine to a trusted state.
RESULTS
1. The initial access vector was confirmed and dated
Two sessions were identified against the unattended-access profile, the first a credential test just over a week before the attack, the second the intrusion itself. Both were attributed to a mechanism supported by logs, not to an assumption.
2. The encryption scope was bounded
Encryption was confined to one workstation and the purchasing folder on the branch file server, reached over an existing mapped drive. No other server or workstation examined at either site was affected.
3. No persistence was found anywhere in the environment
The absence of any foothold mechanism established that the adversary's repeatable route back was the unattended remote access itself, which narrowed remediation to a specific, closable control rather than an open-ended hunt.
4. The data-theft question was answered as far as the evidence allows, and left open where it does not
The encryptor has no data-theft function, the ransom note made no theft claim and offered no leak site, no archiving or transfer tooling appeared on any examined host, and network usage during the attack was lower than routine support sessions. Exfiltration is therefore assessed as unlikely. It cannot be excluded, because the perimeter records that would settle it were never provided.
5. The perimeter exposures were documented for remediation
The firewall review identified a remote-access service published to the internet without multi-factor authentication, a rule granting remote users every service across the whole site network, generic shared remote-access accounts, and a management interface reachable from the internet.
Every one of these issues existed prior to the encryption phase and could have been mitigated beforehand. Interrupting this attack chain required straightforward, fundamental safeguards: enforcing individual user credentials rather than shared logins, deploying multi-factor authentication across all remote entry points, disabling unattended access except where essential — and limiting it to authorised endpoints when deployed — maintaining actively monitored backups, and establishing a formal service agreement with the managed provider to govern log retention and availability. Preventing the breach did not rely on spotting the attacker within that four-minute window; it required proactive security decisions made months prior.
FREQUENTLY ASKED QUESTIONS
1. How were attackers able to encrypt a server that was never exposed to the internet?
They did not attack the server directly. The ransomware ran on a workstation that already had a mapped network drive to a shared folder on that server, so it simply used the permissions the workstation legitimately held. Internal-facing servers inherit the risk of every machine that can reach them, which is why network segmentation and tight share permissions matter as much as perimeter controls.
2. Was any data stolen?
On the available evidence, data theft is assessed as unlikely: the ransomware has no theft capability, the ransom note made no claim that data had been taken, and no collection or transfer tooling was found. However, the perimeter firewall and remote-access logs that would confirm or rule out an outbound transfer were held by a third-party provider and never supplied, so the question cannot be closed. Blackpanda does not report an unanswerable question as answered.
3. Why did the anti-virus not stop the attack?
The endpoint anti-virus stopped running three minutes into the adversary's session and did not restart for over a day, so it produced no detection at all during the encryption. Whether it was deliberately disabled cannot be confirmed from the host logs, though the timing is consistent with it. The practical lesson is that protection status needs active monitoring: a product that silently stops is invisible in a way that a product that merely misses a sample is not.
4. Would backups have made this recoverable?
Working backups would have made the encrypted purchasing records restorable, but the branch backup jobs had been failing daily for roughly two months before the attack, and nobody was alerted. Ransomware operators also target backup infrastructure directly, as happened in a separate case where backups were wiped before encryption. Capacity alerts, job-success monitoring and an offline or immutable copy are the minimum.
5. Could this have been contained before any encryption happened?
Yes, where the intrusion is detected during the access phase rather than the encryption phase. In another manufacturing intrusion Blackpanda investigated, encryption was avoided entirely because the adversary's activity was identified before the payload ran. The determining factor is usually whether remote-access authentication is monitored and whether anyone acts on an unexpected session at three in the morning.
6. Was this a LockBit attack?
The encryptor was built from the LockBit 3.0 builder, which a developer leaked publicly on 21 September 2022, making it available to any operator with no connection to the original group. This sample behaved unlike the mainline operation: it left file names intact, ran no leak site, and used an email-only ransom note. Blackpanda therefore attributes the family with medium-high confidence and makes no attribution to any named group.
WHAT THIS MEANS FOR YOUR ORGANISATION
Most organisations treat remote-access tooling as an IT convenience rather than an authentication boundary, and that is where this incident began. Unattended access turns a single saved password into a route from the internet to a desktop that never touches the firewall, and once that desktop is reached, every mapped drive on it becomes reachable too. The pattern recurs across sectors: one shared credential, one unmonitored tool, one night in which nothing is watching.
Two high-priority measures should be prioritised this week. First, audit all remote-access utilities deployed across the IT environment to identify those with unattended access enabled; these must be disabled or constrained to sanctioned endpoints protected by multi-factor authentication. Second, verify that backup job alerts are actively monitored and reviewed, as an unmonitored backup failure lasting two months renders any recovery strategy purely theoretical. For organisations seeking to have an incident response team pre-engaged rather than negotiating terms during an active crisis, IR-1 provides proactive, pre-arranged response coverage.
ABOUT BLACKPANDA
Blackpanda is Asia's leading cyber incident response company, delivering digital emergency response across three integrated channels: IR consulting, IR-1 assurance subscriptions, and Lloyd's of London-underwritten cyber insurance. Each is purpose-built for a different buyer, whether enterprise, mass market, or sophisticated risk-transfer clients, and each stands alone as full incident response. Together, these channels reach the entire commercial market, because our mission is to provide digital emergency response for everyone. Buy all three and they combine into the complete post-attack recovery solution: preparation in advance, response the moment you're hit, and financial recovery paid for by insurance. One local team to help you get ready, respond, and recover.
