Key facts
- Organisation
- Philippine technology firm
- Threat
- Ransomware run against the virtualisation platform, with a double-extortion listing
- Initial access
- Not determined; the logs that would have shown it had already rolled over
- Impact
- Seven virtual machines left unbootable, both domain controllers among them, and staff unable to log on
- Core issue
- Seven weeks of undetected access, no multi-factor authentication on administrative paths, and log retention too short to investigate
What this case shows
- Endpoint protection sitting inside a virtual machine cannot see an attack that runs beneath it.
- Ransomware does not need to encrypt much to stop a business. A fraction of a disk is enough.
- Short log retention is not a minor housekeeping issue. It decides whether root cause can ever be established.
- A leak-site listing is a claim, not a finding. Without network telemetry, theft cannot be ruled out either way.
If an attacker were reconnecting to your network every morning, you would want to know now rather than later — talk to us about a Compromise Assessment, or reach the team directly through Emergency Incident Response.
What this would have cost with Blackpanda IR-1 in place
| ODIR | IR-1 | |
|---|---|---|
| Type of engagement | On-demand incident response | Yearly subscription |
| Hours covered | 90 hours | Unlimited* |
| Pricing1 | USD $45,000 | USD $4,500 |
* Unlimited for one incident per year
1 Ad-hoc incident response pricing based on average market rates, from USD 500 per hour. Blackpanda IR-1 subscription pricing based on no. of endpoints, costing approx. 10x less than ad-hoc and retainer-based incident response. All figures are illustrative only, for guidance and marketing purposes and not to be relied upon by the reader. Actual incident response costs vary by scope, complexity, and provider.
CHALLENGE
Operating on a single physical host, the firm ran the core of its business infrastructure across a small cluster of virtual machines, including a terminal server, an application server, an HR system, a file server, and two domain controllers. While consolidating operations onto one host reduces overhead and simplifies management for mid-market businesses, it concentrates all risk in a single location.
Employees arriving at work one day in April 2026 discovered they were unable to log in. The network address service had failed, preventing any device from connecting to the network. Upon inspecting the host, the IT team discovered multiple virtual machines had been encrypted, with all files renamed using an unfamiliar extension and ransom notes placed in every impacted folder. A member of the overseas support desk had been the first to spot the note.
In total, seven virtual machines failed to start, including both domain controllers. Because the malicious code had been executed at the hypervisor level rather than within individual guest operating systems, a single run impacted every VM simultaneously. This allowed the attack to encrypt files directly at the virtualisation layer, bypassing the endpoint security measures active inside the virtual machines. The organisation severed connections to the host, alerted law enforcement and the national data protection authority, and engaged Blackpanda roughly a week later.
At the time, no one in the company knew how long the adversary had maintained access. The extent of the breach became clear only after Blackpanda extracted forensic evidence from the encrypted disks, uncovering an intrusion that had begun almost two months earlier.
SOLUTION
1. Recover evidence from disks that were already encrypted
By carving artefacts directly from encrypted virtual disk images and extracting logs from intact backups, Blackpanda reconstructed a functional evidentiary record from data that initially appeared entirely unusable — reclaiming vital forensic history from locked systems.
This vital recovery effort laid the groundwork for all subsequent investigation; lacking it, the organisation would have possessed only a ransom demand and zero visibility into the breach history.
2. Reconstruct the intrusion end to end
Working from recovered file-system metadata, service registrations and authentication records, Blackpanda placed the first confirmed attacker action in February 2026, on a terminal server, seven weeks before the encryption. A reverse-proxy implant had been written to that host and set to start automatically at boot, disguised as an operating-system component and given a service description copied word for word from a legitimate networking service.
The intrusion expanded from that initial access point. Leveraging the built-in domain administrator credentials, the threat actor accessed a domain controller and deployed a second iteration of the implant. During March 2026, they executed an inventory script against the directory on two separate occasions before erasing their command history and deleting the script itself. This sequence of lateral movement ultimately culminated at the virtualisation host.
3. Find and close every route back in
An investigation uncovered two distinct persistence methods, demonstrating the adversary’s intent to establish long-term access. Beyond configuring two implant services on the servers themselves, the attacker added a Secure Shell (SSH) key to the host system’s root account and launched a secondary remote shell on a non-standard port, which served dual function as a command-and-control channel.
Following Blackpanda’s guidance, the organisation successfully eliminated both implant services, removed the unauthorised root key, and terminated the secondary listener. Subsequent threat hunting across the environment confirmed no remaining traces of attacker access.
4. Test the data-theft claim against the evidence
The listing of the organisation on a leak site brought the potential exfiltration of data into sharp focus. Blackpanda conducted an extensive review of all available network records and cross-referenced indicators associated with the adversary’s infrastructure across recovered systems, detecting no evidence of data leaving the network.
However, the absence of comprehensive network telemetry and the truncation of key historical logs prevented a definitive exclusion of data theft. Blackpanda chose to communicate this constraint directly, declining to present incomplete records as conclusive proof.
RESULTS
1. Seven weeks of hidden access, documented
Blackpanda established that the attacker had held a working route into the network since February 2026, and that the implant re-established its tunnel every morning at roughly the same time for the whole period.
2. The blast radius explained
Byte-level analysis of one encrypted 90GB disk showed that less than a tenth of one per cent of it had actually been encrypted, concentrated at the start and end of the disk where the boot record and partition tables live. Barely touched, and completely unbootable.
3. Both persistence routes eliminated
Two implant services, their binaries, an attacker-controlled key and a hidden listener on the virtualisation host were all identified and removed, and follow-up hunting turned up no residual access.
4. Detection gaps quantified
Roughly 30 corporate endpoints lacked any endpoint protection agent. Although an agent was active on one domain controller, it logged the malicious executable without issuing an alert, as the file’s name and description masqueraded as a native operating system component.
5. Root cause bounded, not guessed
The original entry point could not be identified. Because remote-access and firewall logs had already rolled over prior to Blackpanda’s engagement, Blackpanda explicitly noted the evidentiary limitation instead of proposing an unsupported hypothesis.
Across these five findings, a recurring vulnerability emerges: every phase of the breach relied on unmonitored activity. Key events — such as a service registration on a jump host, an atypical Remote Desktop Protocol (RDP) connection between servers, an administrative key added to a hypervisor, and security controls disabled twice despite platform alerts — went completely unnoticed. The activity was clear, but unobserved for seven weeks, ultimately resulting in the compromise of seven servers and business disruption. Implementing comprehensive endpoint coverage, extending log retention periods, and enforcing multi-factor authentication for administrative access would have contained the intrusion earlier and likely prevented the deployment of ransomware.
FREQUENTLY ASKED QUESTIONS
1. How did the attacker get in?
The exact entry point remains undetermined — a reality of the investigation. Because Blackpanda was brought in nearly two months after the initial compromise, critical remote-access and firewall logs had already expired and rolled over. While digital forensics enabled the reconstruction of all subsequent threat activity with high confidence, the initial vector of entry was no longer recoverable.
2. If someone was inside for seven weeks, why did nothing alert?
Three core blind spots allowed the activity to go undetected. First, encryption occurred at the virtualisation host layer, where standard endpoint monitoring cannot operate. Second, approximately 30 corporate systems lacked agent coverage entirely. Finally, on the single monitored server, the implant masqueraded convincingly enough that security software logged its presence without generating an alert. A comparable pattern of visibility gaps is detailed in a ransomware response for a Singapore-based commodity trading firm.
3. Only a fraction of each disk was encrypted. Why was the damage total?
Modern ransomware prioritises speed over comprehensive encryption. By targeting only the boot record and partition tables located at both ends of each disk, it effectively prevents systems from booting. Although the underlying file system remains mostly intact, it becomes completely unusable because the system can no longer access it.
4. We were listed on an extortion site but no data has appeared. Does that mean nothing was taken?
No. An extortion listing reflects the adversary’s assertions, which can sometimes be bluffs; conversely, the lack of leaked records does not confirm safety. In this instance, Blackpanda identified no forensic proof of exfiltration but could not definitively rule it out due to missing log coverage for the period in question. When empirical evidence is present, it can be uncovered, as illustrated by a dark web data leak investigation.
5. Should our virtualisation host be reachable from the internet?
No. CISA and the FBI are explicit that hypervisors should not be exposed to the public internet, and that management access belongs behind controlled pathways, in their guidance on ransomware targeting virtualisation platforms. Administrative interfaces should sit on a segmented management network, reachable only from dedicated workstations, and every one of those paths should require multi-factor authentication.
6. Our backups run on the same platform as everything else. Is that a problem?
Indeed, this incident highlights that vulnerability: when ransomware compromises a physical host, every system residing on it — including essential recovery tools — is impacted. Given that threat actors routinely target backups initially, CISA’s #StopRansomware Guide advises maintaining offline, encrypted backups of critical data alongside routine testing of their integrity and availability. Maintaining immutable or offline backups of core business servers, hypervisors, and directory infrastructure should therefore be treated as an essential recovery requirement rather than an optional safeguard.
WHAT THIS MEANS FOR YOUR ORGANISATION
While host virtualisation and server consolidation offer undeniable engineering efficiency, they silently introduce a severe risk: the hypervisor turns into a single point of absolute failure. Because it operates beneath standard endpoint security controls, a compromised hypervisor grants an adversary complete control over every hosted asset. Businesses routinely invest heavily in endpoint monitoring while leaving the underlying virtual platform unmonitored — a critical oversight.
Two foundational, cost-effective security controls could have fundamentally altered this breach trajectory: enforcing multi-factor authentication across all remote access and administrative channels to shut down lateral movement, and extending log retention periods to enable comprehensive root-cause analysis. Implementing these safeguards proactively is far simpler than reacting during a crisis — underscoring the strategic necessity of proactive incident response preparation and maintaining a dedicated incident response partner on retainer through IR-1 before an emergency strikes.
ABOUT BLACKPANDA
Blackpanda is Asia's leading cyber incident response company, delivering digital emergency response across three integrated channels: IR consulting, IR-1 assurance subscriptions, and Lloyd's of London-underwritten cyber insurance. Each is purpose-built for a different buyer, whether enterprise, mass market, or sophisticated risk-transfer clients, and each stands alone as full incident response. Together, these channels reach the entire commercial market, because our mission is to provide digital emergency response for everyone. Buy all three and they combine into the complete post-attack recovery solution: preparation in advance, response the moment you're hit, and financial recovery paid for by insurance. One local team to help you get ready, respond, and recover.
