Key facts
- Organisation
- Hong Kong retail group
- Threat
- Ransomware, deployed with a double-extortion model
- Initial access
- An internet-facing SSL-VPN with weak account controls, assessed as the most likely entry point
- Impact
- Around 100 virtual machines unavailable, around a dozen confirmed encrypted, storage and backup repositories destroyed, and almost 70,000 files later published
- Core issue
- Over 400 VPN accounts in use, around 60 of them without multi-factor authentication, and roughly a week of retained logs
What this case shows
- Attackers now treat backups as the first target, not an afterthought. Recovery capability was dismantled hours before any file was encrypted.
- Log retention measured in days, rather than months, can make the root cause of an intrusion permanently unrecoverable.
- One remote-access account without MFA is enough. The count of accounts that do have it is not the measure that matters.
- Paying attention to the leak site is part of incident response. The extortion continues long after the encryption stops.
If your remote access sits exposed to the internet, a compromise assessment will tell you what is already inside, and IR-1 puts a response team on standby before you need one.
What this would have cost with Blackpanda IR-1 in place
| ODIR | IR-1 | |
|---|---|---|
| Type of engagement | On-demand incident response | Yearly subscription |
| Hours covered | 190 hours | Unlimited* |
| Pricing1 | USD $95,000 | USD $9,500 |
* Unlimited for one incident per year
1 Ad-hoc incident response pricing based on average market rates, from USD 500 per hour. Blackpanda IR-1 subscription pricing based on no. of endpoints, costing approx. 10x less than ad-hoc and retainer-based incident response. All figures are illustrative only, for guidance and marketing purposes and not to be relied upon by the reader. Actual incident response costs vary by scope, complexity, and provider.
CHALLENGE
The group runs a retail operation across Hong Kong and, like most businesses of its size, its network had grown faster than documentation could keep up with. Hundreds of staff and contractors connected through an SSL-VPN, a service that lets remote users tunnel into the internal network as though they were sitting at a desk in the office. Over 400 accounts were active on it. Roughly 60 of these accounts lacked multi-factor authentication, the crucial verification layer that prevents a compromised password from guaranteeing entry on its own.
One morning in April 2026, staff arrived to find the ordering system unreachable and the internet down. IT checked the network equipment, found nothing wrong, and roughly two hours later someone discovered a ransom note sitting on a server. The company severed its headquarters internet connection immediately. By then, a handful of user machines were already encrypted, around 100 virtual machines had gone dark, and the ordering system that the retail business ran on was simply gone. Ransomware that reaches a virtualisation platform does not encrypt one computer at a time; it takes down dozens of servers in a single pass, which is exactly what had happened here and what Blackpanda has seen in other attacks on virtualisation platforms.
What the company did not yet know was that the encryption was the attackers’ last step, not the first. In the hours before the encryptor ran, the intruders had methodically taken apart the recovery path: backup services stopped, replication packages uninstalled, scheduled backup jobs deleted, storage volumes removed, administrator passwords changed. On one storage device they did not bother encrypting at all. They destroyed the disk partition outright, which is faster and just as final.
Nor did the company know how long the attackers had been inside, and the logs could not tell them. The perimeter appliance retained roughly a week of records. The intrusion had begun well before that window opened.
SOLUTION
1. Activate the same day and stop the bleeding
Blackpanda responded on the day of the engagement. The first priority was containment rather than analysis: establish which systems were still clean, confirm whether the disaster-recovery site had been touched, and get forensic collection tools onto every affected machine so that new attacker activity would be visible rather than inferred. That telemetry became the backbone of everything that followed.
2. Trace the entry point back through the remote-access perimeter
Investigators worked backwards from the earliest malicious activity to the network edge. Public scanning services had already indexed the company's VPN portal and its administrative interface, both reachable from the open internet, and the appliance's external address was publicly associated with the organisation. Reviewing the account configuration surfaced the real problem. Alongside the accounts missing MFA, more than 70 used passwords weak enough to fail the assessment's threshold, and several policies granted full-tunnel access to a broad internal range rather than to the specific systems those users needed. Two accounts appeared to have been created by the attackers themselves.
3. Map the credential theft and the movement it enabled
The team reconstructed how the intruders turned one foothold into control of the environment. They dumped the directory credential database from a domain server using built-in system utilities, walking away with password hashes for the entire domain. A separate burst of over 30,000 failed logon attempts against a built-in administrator account never succeeded, but it showed how hard they were pushing. Later, forged-ticket activity gave them authentication that looked legitimate to every system that checked it. From there the pattern was familiar: lateral movement across servers by remote desktop, using a stolen administrative account, over roughly two weeks. A password-strength assessment of the recovered databases confirmed what the movement implied, with weak and reused credentials on privileged accounts throughout.
4. Root out persistence and watch the extortion play out
Containment is worthless if the attacker still has a way back in. Blackpanda found a backdoor on one server where a renamed binary, disguised as a common browser executable, spawned a scripting process and beaconed out to an external command-and-control domain already flagged for proxy abuse. That domain went onto the block list across every firewall. In parallel, darknet monitoring tracked the extortion, and Blackpanda supported the company and its legal advisers through enquiries from the local police and the data protection regulator.
RESULTS
1. The entry point was identified and closed
Blackpanda assessed the exposed SSL-VPN as the most likely initial access vector and specified the fixes: MFA on every account, removal of the attacker-created accounts, and replacement of full-tunnel policies with least-privilege rules.
2. Attacker persistence was removed
The command-and-control backdoor, the scanning tools, the encryptor, and the account the attackers created on the storage device were all identified and eliminated, with the C2 domain blocked across the estate.
3. Credential exposure was quantified rather than guessed
The password-strength assessment turned a vague worry into a specific list of weak and reused privileged credentials, which let the company scope its reset properly instead of hoping it had caught everything.
4. The extortion picture was made clear
Monitoring confirmed the full scope of the double extortion. The attackers first claimed almost 200GB of stolen data, then published around 90GB, comprising almost 70,000 files, on a leak site after the deadline lapsed.
5. Regulatory exposure was handled with support, not alone
Blackpanda worked alongside the company's legal advisers on enquiries from law enforcement and the privacy regulator, so the technical findings and the regulatory narrative stayed consistent.
Two of the conditions that made this incident so damaging cost nothing to fix in advance. Multi-factor authentication on remote access would have blunted the initial intrusion, and log retention measured in months rather than days would have let investigators establish the root cause with certainty instead of assessment. The third, backups the attacker cannot reach, is the difference between an outage and an extinction event. Every organisation running a virtualisation estate should assume its backup infrastructure is a primary target and design accordingly, because the attackers already do.
FREQUENTLY ASKED QUESTIONS
1. How did the attackers get in?
Blackpanda assessed the internet-facing SSL-VPN as the most likely entry point, based on its public exposure and the state of its account controls. The specific account and method could not be confirmed because the appliance retained only about a week of logs, and the intrusion predated that window. This is a common and frustrating outcome, and it is why log retention is a security control rather than an IT housekeeping matter.
2. Why did the backups not help?
Because the attackers destroyed them first. They stopped backup services, uninstalled the replication software, deleted scheduled jobs and storage volumes, changed administrator passwords, and on one device wiped the disk partition entirely. Backups only protect you if they are offline, immutable, or otherwise out of reach of an attacker holding domain credentials.
3. What does “double extortion” actually mean for the business?
The attackers encrypt your systems and separately steal your data, then threaten to publish it. Even a company that recovers cleanly from backup still faces the second demand. Here, almost 70,000 files covering financial records, contracts, purchase orders and HR documents went public after the deadline passed.
4. Would multi-factor authentication have stopped this?
It would have made the intrusion significantly harder. CISA's #StopRansomware Guide recommends MFA on all VPN connections precisely because remote access is where these intrusions so often begin. Around 60 accounts here had none, and it takes only one.
5. How long were the attackers inside before anyone noticed?
Evidence places malicious activity in the environment for at least two weeks before the encryption ran, and possibly longer than the logs could show. That dwell time is typical. Our case study on a ransomware attack against a Hong Kong engineering company documents a similar pattern of quiet preparation before the visible damage began.
6. What should we do first if we think this is happening to us?
Isolate rather than shut down, because powering off a machine destroys volatile evidence that may be the only record of how the attacker got in. Then call an incident response team. Blackpanda can be reached through the emergency incident response form at any hour.
WHAT THIS MEANS FOR YOUR ORGANISATION
The shape of this attack is now the standard. Attackers get in through exposed remote access, harvest credentials, move sideways until they hold the virtualisation and storage layers, and only then encrypt, having first spent hours ensuring you cannot restore. Treating backup infrastructure as a recovery asset rather than as a primary target is the assumption that keeps failing organisations across the region.
Two controls carry disproportionate weight here. Enforce MFA on every remote-access account without exception, and hold logs long enough that an investigation six weeks later still has something to read. Beyond that, the variable that determines how bad an incident becomes is how quickly a response team is working the problem. This company engaged Blackpanda on the day it discovered the ransom note, which is why the investigation had evidence to work with at all. IR-1 exists so that call happens in minutes rather than days, at roughly a tenth of what on-demand response costs after the fact.
ABOUT BLACKPANDA
Blackpanda is a Lloyd's of London–accredited insurance coverholder and Asia's leading local cyber incident response firm, delivering end-to-end digital emergency support across the region. We are pioneering the A2I (Assurance-to-Insurance) model in cybersecurity — uniting preparation, response, and insurance into a seamless pathway that minimises financial and operational impact from cyber attack. Through expert consulting services, response assurance subscriptions, and innovative cyber insurance, we help organisations get ready, respond, and recover from cyber attacks — all delivered by local specialists working in concert.
Our mission is clear: to bring complete cyber peace of mind to every organisation in Asia, from the first moment of breach through full recovery and beyond.
