Key facts
- Organisation
- Food & Beverage Group, Singapore
- Threat
- NightSpire ransomware, double extortion
- Initial access
- Internet-facing remote-access portal on a network appliance years past end of support, with no multi-factor authentication
- Impact
- Almost 15 million files encrypted across five systems, the backups included; over 30GB of corporate data staged for removal
- Core issue
- The appliance stored a domain-administrator credential, so reaching the perimeter meant controlling the domain
What this case shows
- An end-of-life device on the perimeter is not a patching backlog item. It is the shortest path to the whole network.
- Backups encrypted alongside production data leave no internal way back, whatever the recovery plan says.
- The group's own list of affected systems was incomplete, and the machine it left off was the one the attacker had been working from. Ransomware never ran on that host, so the tooling, the backdoors and the accounts the attacker had built were all still sitting on it. Without that machine, the investigation could have described the damage but not the intruder, and the group would have had to rebuild, over a way back in.
If an attacker is inside your network now, our team can be engaged for emergency incident response, or you can put a response subscription in place before the call is urgent with Blackpanda IR-1.
What this would have cost with Blackpanda IR-1 in place
| ODIR | IR-1 | |
|---|---|---|
| Type of engagement | On-demand incident response | Yearly subscription |
| Hours covered | 75 hours | Unlimited* |
| Pricing1 | USD $37,500 | USD $3,750 |
* Unlimited for one incident per year
1 Ad-hoc incident response pricing based on average market rates, from USD 500 per hour. Blackpanda IR-1 subscription pricing based on no. of endpoints, costing approx. 10x less than ad-hoc and retainer-based incident response. All figures are illustrative only, for guidance and marketing purposes and not to be relied upon by the reader. Actual incident response costs vary by scope, complexity, and provider.
CHALLENGE
The group runs a food and beverage business in Singapore, and its system arrangement looked unremarkable until somebody examined it closely. One network appliance stood between the internet and the entire system, publishing a remote-access portal to the world on firmware left unpatched for more than four years. No account on that device asked for a second factor. Worse, the account it used to check staff logins against the company directory was the domain administrator itself, the most privileged credential in the business, sitting in the configuration of an internet-facing box.
In May 2026, somebody signed in through that portal from a device nobody recognised, minutes after a short run of failed attempts. Within hours, the intruder held the domain controller and had replicated every password in the domain. The ransomware attack that followed was not the beginning of the incident, but the end of it.
Staff noticed something wrong the next day. The attacker kept working anyway for the rest of the week, scanning the network for anything worth taking, consolidating HR, accounting, operational and facilities files into seven archives totalling over 30GB, and installing a file-transfer client on the machine it had made its base. Then, it uninstalled the endpoint protection product on that host, switched off the operating system's built-in defences, and ran the payload. Almost 15 million files across five systems were encrypted in three days. So were the backups, and so were the certificates the backup agent needed, leaving the firm with nothing clean to restore from inside its own walls.
One crucial detail the firm did not know was that the machine the attacker had actually been working from was absent from its own list of affected systems. It was never encrypted, because the endpoint product had quarantined the payload there days earlier. Everything the attacker had built, the persistence, the remote-access tooling, the credential theft service, was still sitting on the machine when Blackpanda arrived.
SOLUTION
1. Contain first, then collect
Blackpanda's priority on arrival was to stop the bleeding and preserve what remained. The team isolated the affected systems, then took forensic triage collections across the domain controller, both storage devices, the staff laptop and the workstation the attacker had used, along with the appliance configuration and whatever logs it still held.
2. Reconstruct the intrusion in the order it happened
Rather than treat the encryption as the event, the team worked backwards from it. Service installations, authentication records, file-system timelines and the surviving perimeter logs were correlated into a single sequence, which established when the attacker arrived, how it obtained domain credentials, and how the lateral movement across the environment unfolded.
That reconstruction also settled the entry point question as far as the evidence allowed. The appliance was the probable route in, and the team said so plainly while recording why direct confirmation was impossible.
3. Establish what left the building
Blackpanda tested three separate questions
- Was there data worth taking?
- Was there a means of moving data?
- Is there a record of data moving?
The first two were well evidenced. The third could not be established, because the storage devices logged no file transfers and the appliance logs did not reach the period. The team reported the staged archives as the upper bound of what was exposed instead of inflating or dismissing the risk.
4. Hunt for what was left behind
An indicator sweep across the endpoint platform surfaced the launch host the firm had not listed. The team then ran a week of forward monitoring alongside dark web and leak-site watching, while Blackpanda's negotiation specialists handled contact with the group.
RESULTS
1. The way in was identified and closed
Blackpanda named the internet-facing appliance as the probable entry point and set out the configuration weaknesses that made it one, including the domain-administrator credential stored on the device itself.
2. The scale of the credential exposure was established
Because the attacker replicated the directory, the team advised the firm to treat the entire domain credential base as compromised, a full domain compromise rather than a handful of stolen passwords.
3. Data exposure was bounded honestly
The team quantified what had been staged, over 30GB spanning HR, financial and operational records, and stated clearly that the outbound transfer itself could not be measured from the available evidence.
4. The hidden launch host was found
A machine missing from the firm's own scope list turned out to be the origin of the intrusion, and it was still running attacker persistence and remote-access tooling at the time of collection.
5. The environment was cleared and watched
Over a week of forward monitoring, no ongoing, residual or recurring malicious activity appeared on the enrolled endpoints, and no client data or credentials surfaced on the group's leak site during the engagement.
Almost none of this required advanced tradecraft to defeat. Multi-factor authentication on the remote-access portal, a low-privilege account for directory lookups instead of the domain administrator, logs written somewhere other than volatile memory, and one immutable backup copy would each have broken the chain at a different link. The firm was not outclassed. It was under-configured, and the attacker read the configuration correctly.
FREQUENTLY ASKED QUESTIONS
1. How did attackers get in without anything sophisticated?
They signed in. The remote-access portal was reachable from anywhere on the internet, protected by a password alone, on firmware that had stopped receiving security fixes years earlier. When a valid credential is all a portal asks for, an attacker with a valid credential is simply a user.
2. Why couldn't the exact entry point be confirmed?
The appliance wrote its logs to memory only, with no external collector, so the record did not reach back into the intrusion window. The domain controller's security log was similarly short. Blackpanda reported the appliance as the most probable route and recorded the evidence gap rather than presenting an assessment as a finding.
3. Was data actually stolen?
Data was accessed and packaged for removal, and a file-transfer tool was installed and run on the staging host. Whether it left, and how much, could not be proven from the surviving evidence. The staged archives therefore represent the upper bound of the exposure, which is what the firm needed for its notification assessment.
4. Why did losing the backups matter so much?
Encrypting production data forces a restore. Encrypting the backups, and destroying the certificates the backup agent depended on, removes the restore. That combination is deliberate, and it is why offline or immutable copies matter more than backup frequency.
5. Would multi-factor authentication have stopped this?
On this perimeter, almost certainly. A stolen password alone opened the portal, and a second factor would have stood in the way. Multi-factor authentication is not absolute, though, and attackers do defeat it, as our case study on an MFA bypass attack at a Singapore IT services firm shows.
WHAT THIS MEANS FOR YOUR ORGANISATION
The pattern here is not a clever attacker. It is a perimeter device that nobody owned. Edge appliances tend to fall between the network team and the security team, they get replaced on hardware cycles rather than support cycles, and they quietly accumulate exceptions: a portal opened to everyone during a remote-working push, a directory account borrowed from an administrator because it was quicker, logging left at the default. Each decision was reasonable in isolation. Together they formed a straight line from the public internet to the domain controller.
Two things are worth doing this quarter regardless of your incident history. Establish who owns each internet-facing device, what version it runs, and when its support ends. Then test whether one backup copy exists that an attacker holding domain-administrator credentials cannot reach or delete. If the answer to either is uncertain, a compromise assessment answers it faster than an incident will, and a response subscription such as Blackpanda IR-1 means the first call after a discovery is to a team that already knows your environment.
ABOUT BLACKPANDA
Blackpanda is a Lloyd's of London–accredited insurance coverholder and Asia's leading local cyber incident response firm, delivering end-to-end digital emergency support across the region. We are pioneering the A2I (Assurance-to-Insurance) model in cybersecurity — uniting preparation, response, and insurance into a seamless pathway that minimises financial and operational impact from cyber attack. Through expert consulting services, response assurance subscriptions, and innovative cyber insurance, we help organisations get ready, respond, and recover from cyber attacks — all delivered by local specialists working in concert.
Our mission is clear: to bring complete cyber peace of mind to every organisation in Asia, from the first moment of breach through full recovery and beyond.
