2:14 AM Ransomware Containment
Full Recovery by 6 AM
IDENETY MSP's 24/7 SOC detected lateral movement at 2:14 AM. Engineers isolated the affected segment, contained the threat within 22 minutes, and restored operations from immutable backup — full recovery before business hours.
The Situation
A San Antonio professional services firm with 45 endpoints across 3 locations was a managed client on IDENETY MSP's COMPLETE plan, which includes 24/7 SOC monitoring with SIEM and EDR/XDR. At 2:14 AM on a Tuesday, IDENETY MSP's SOC detected anomalous lateral movement — a compromised endpoint was attempting to enumerate file shares and access domain controllers. The attack vector was a phishing email with a malicious macro that had been opened by a user the previous afternoon, with the ransomware payload activating overnight.
Incident Response Timeline
Lateral Movement Detected
IDENETY MSP's 24/7 SOC detected anomalous lateral movement across the client's network. SIEM correlation identified a compromised endpoint attempting to access file shares and domain controllers.
Incident Declared
SOC analyst declared a P1 incident and initiated the Incident Response playbook. Client's designated emergency contact was notified via phone.
Network Isolation
Affected network segment isolated via firewall policy change. Compromised endpoint quarantined via EDR. Lateral movement stopped.
Threat Contained
Ransomware payload confirmed contained to 3 endpoints. No domain controller compromise. No data exfiltration confirmed via DLP monitoring. 22 minutes from detection to containment.
Forensic Analysis
IDENETY MSP engineers began forensic analysis of the compromised endpoints. Initial vector identified: phishing email with malicious macro opened by a user the previous afternoon.
Recovery Initiated
Immutable backup restoration initiated for the 3 affected endpoints. Backup integrity verified — no ransomware contamination in backup chain.
Full Recovery
All 3 endpoints restored and verified clean. Network segment brought back online. Full operations restored before business hours. Zero data exfiltration confirmed.
What Made This Outcome Possible
Is Your Business Protected at 2 AM?
IDENETY MSP's 24/7 SOC monitors your endpoints around the clock. Book a free assessment to see your current security posture.