Asia-Pacific Manufacturer Faces Two-Month Intrusion via Hidden Backdoors Disguised as Vendor Services

‍

‍

‍

CHALLENGE

The organisation ran its primary regional environment on network-attached storage (NAS) devices, which are file servers connected directly to the network, alongside virtualisation hosts and data-centre web servers. That environment was connected to the organisation's other sites without enforced segmentation, and no endpoint detection covered its servers or storage. In February 2026, a threat actor entered the environment from an attendance system at another of the organisation's sites and logged in to the first storage device with valid credentials already in its possession. Because no brute-force or other credential-access activity preceded that login, how the credentials were obtained could not be established.

Over the following weeks, persistent access was layered across the environment: a backdoor administrator account was created under a name resembling a legitimate vendor service; reverse tunnelling tools, which hold an outbound channel open to attacker-controlled infrastructure, were installed under storage-vendor and health-monitoring service names; and an independent secure shell (SSH) backdoor provided a second route in. Furthermore, a log-wiping routine was run after each session. Within two weeks of first access, the same tunnelling tool had been implanted on a data-centre web server, disguised as an operating system service.

Consequently, when activity resumed after a pause of more than a month, the threat actor held several independent routes back into the environment. Across two days in April 2026, a purpose-built ransomware encryptor was deployed to the storage devices, after which two hypervisor hosts were reached through a look-alike service account and encrypted with a separate encryptor. File shares, virtual machines and departmental systems became unavailable, and the organisation engaged Blackpanda later that month.

What the organisation did not yet know was that its means of recovery had become a target in its own right. In the days that followed, backup and logging packages were uninstalled, storage snapshots were deleted and the drives of data-centre web servers were wiped through a commercial remote-access tool.

‍

SOLUTION

1. Scoped the investigation to the primary regional environment and the evidence that survived

Blackpanda and the organisation jointly scoped the investigation to the domain controllers, servers, hypervisors and storage devices in the primary regional environment, together with the available firewall and VPN logs. However, the evidence base was incomplete: system logs, command histories and management-interface logs had been deleted from the storage devices, firewall logs covering the attack period had been overwritten before collection, two domain controller images were corrupted, and affected endpoints had been reset before forensic acquisition.

2. Recovered deleted activity from the physical disks of the storage devices

To recover what the log wiper had removed, Blackpanda carved the physical disks of the compromised storage devices, reconstructing the backdoor account, the tunnelling implants and their persistence units, and the encryptor with its wrapper script. These artefacts established the lateral movement path from the second site to the storage layer, then to the data centre and the hypervisors, as well as the mechanism by which the ransomware was deployed. Not every deleted log was recoverable, so some activity on the storage devices may remain unrepresented in the evidence.

3. Monitored the environment through endpoint detection for the duration of containment

Endpoint detection and response (EDR), which monitors activity on individual machines and can block malicious actions as they execute, was deployed across the organisation's endpoints and servers. Blackpanda then conducted threat detection across its telemetry throughout the containment period, including the window in which the threat actor attempted its final destructive action.

4. Sequenced containment and eradication actions against the identified routes back in

Because multiple independent backdoors were in place and the credential source remained unknown, Blackpanda's short-term recommendations addressed re-entry as well as recovery: isolating compromised systems, disabling the SSL VPN service, taking backups offline and verifying their integrity before restoration, segregating the data centre from connected sites, resetting the domain's Kerberos ticket-granting account twice to invalidate existing authentication tickets, resetting all privileged credentials, and blocking every identified command-and-control indicator at the perimeter and on endpoints.

‍

RESULTS

1. Reconstructed the intrusion path despite deliberate log destruction

The investigation traced the threat actor's movement from another site, through the storage devices and the data centre, to the hypervisors, using artefacts recovered from disk rather than logs that had been wiped.

2. Identified the persistence mechanisms requiring eradication

The backdoor administrator account, the disguised tunnelling implants on storage devices and a web server, and the independent SSH backdoor were each identified, giving the organisation a defined eradication scope.

3. Stopped a delayed wiper before it destroyed over 20 workstations

When a wiper was scheduled against every drive on over 20 workstations in May 2026, the EDR solution detected and blocked it as the deletion reached the wiper's own files. No further threat-actor activity was observed thereafter.

4. Strengthened the environment against re-entry

The organisation enforced stronger network segmentation and rebuilt the affected systems and the domain forest, extending the controls introduced during containment.

Although the initial access vector into the wider network remains unknown, the conditions that allowed this intrusion to progress are well defined, and each can be addressed before an incident occurs. Segmentation that restricts traffic between sites limits how far a foothold at one location can travel; endpoint detection on storage devices and hypervisors, rather than on workstations alone, removes the blind spot in which this activity persisted; centralised logging held off the originating host preserves evidence that an attacker can otherwise delete; and immutable, offline backups ensure that a clean restore point survives even when the live environment and its snapshots do not.

‍

FREQUENTLY ASKED QUESTIONS

1. How can an attacker remain inside our storage devices for weeks without anyone noticing?

Storage devices and hypervisors are frequently left outside endpoint detection coverage, and their local logs can be deleted by anyone who gains administrative access. Without an independent record, an intrusion on those systems can run for weeks. Forwarding logs to a central platform held off the device, and extending detection to storage and virtualisation hosts, removes both conditions. A Philippine technology firm experienced seven weeks of daily attacker access before ransomware reached its servers.

2. Can a compromise at one of our sites spread to the others?

Yes, if the network allows unrestricted traffic between them. A single set of valid credentials, used from a system at one location, can reach file storage, servers and virtualisation hosts at another when no segmentation stands in between. Restricting inter-site traffic to the specific services each site needs, and monitoring the links that remain, confines an intruder to the location where access was first gained.

3. We have backups. Are we protected against ransomware?

Not necessarily, because backups reachable from the production network can be deleted or encrypted with the same administrative access used to deploy ransomware. Snapshots stored on the device they protect carry the same risk. Immutable or offline (air-gapped) copies, restored and tested on a regular schedule, provide a restore point that an attacker cannot alter.

4. Would multi-factor authentication have prevented an attack like this?

Multi-factor authentication (MFA) does not neutralise every credential-based attack, but enforcing it on remote access, administrative accounts and external-facing logins means a stolen password alone no longer grants entry. It is most effective when paired with:

• Local administrator password management: unique, rotated passwords on every device, so that one credential cannot unlock many.
• Credential resets after any incident: domain, local, hypervisor and service accounts alike, since any of them may already be in an attacker's hands.

5. What should we do first if file shares and servers suddenly become unavailable?

Treat it as a ransomware incident until it is proven otherwise:

• Isolate, do not power off: disconnect affected systems from the network while preserving their memory and disks for investigation.
• Take backups offline: protect any remaining recovery copies before verifying their integrity.
• Preserve logs: export firewall, VPN and server logs before they are overwritten.
• Engage responders immediately: report an incident to Blackpanda so that containment begins while evidence is intact.

6. Why might investigators be unable to determine how an attacker first got in?

Root-cause analysis depends on logs that cover the moment of entry, and many firewalls retain only a short window or hold logs in memory that a reboot erases. Once that window passes, the entry point can only be inferred. Retaining firewall and VPN logs off the device for at least three months preserves that evidence; a Malaysian manufacturer lost four months of intrusion evidence to memory-only firewall logging.

WHAT THIS MEANS FOR YOUR ORGANISATION

Storage and virtualisation have become the decisive layer of a ransomware attack: encrypting a hypervisor disables every server it hosts, and deleting snapshots and backup software removes an organisation's ability to recover without negotiation. Those same systems are the least likely to carry endpoint detection, which allows an intruder to remain on them long enough to stage the destruction in phases.

Two actions follow directly. First, organisations should establish whether their storage devices, hypervisors and inter-site links are visible to detection tooling and segmented from one another; a compromise assessment answers that question before an attacker does. Second, investigators must be able to begin before evidence is overwritten, which is what an IR-1 subscription is built to provide for your organisation.

‍

ABOUT BLACKPANDA

Blackpanda is Asia's leading cyber incident response company, delivering digital emergency response across three integrated channels: IR consulting, IR-1 assurance subscriptions, and Lloyd's of London-underwritten cyber insurance. Each is purpose-built for a different buyer, whether enterprise, mass market, or sophisticated risk-transfer clients, and each stands alone as full incident response. Together, these channels reach the entire commercial market, because our mission is to provide digital emergency response for everyone. Buy all three and they combine into the complete post-attack recovery solution: preparation in advance, response the moment you're hit, and financial recovery paid for by insurance. One local team to help you get ready, respond, and recover.