Fighting for survival: Recovering a large Australian enterprise crippled by ransomware

FTI Consulting was asked to help an large Australian enterprise in crisis; this business had woken up to a LockBit ransomware attack, and had unexpectedly lost the ability to operate all of their critical applications, as well as all non-paper records of who their customers were and the balance of their customers' accounts.

In addition to conducting containment, eradication and investigation, we and the organisation's IT service provider was asked to help the enterprise recover its operations as quickly as possible, whilst preventing a reinfection of the organisation's systems. This was a desperate fight for survival; the enterprise had a narrow window in which it could recover, before its financial situation would become unviable, and its customers and the government were likely to take serious action.

As part of this fight for survival, the organisation achieved a technical feat that would normally be unthinkable; they moved their entire enterprise environment from an on-premises data center to the cloud in just three weeks.

To support this, FTI was asked to lead the recovery of the organisation's data within the compromised network, and then subsequently design a complex and bespoke workflow to securely transfer all of the organisation's data and systems from an untrusted the compromised environment into a new cloud environment.

This talk covers the chronology of the recovery process and the lessons learned, including unexpected roadblocks that were encountered.