LockBit encrypts OA and file servers after wiping the backups

The client is a public-sector organization running OA, document circulation, a portal and several file servers on an internal network, all joined to a single Windows domain. A backup server orchestrated all jobs into network storage, with both the backup service and storage management using domain administrator accounts — the classic "backups in the same domain with the same credentials as production" arrangement.

The intrusion had run for some time before discovery. The attacker entered through a host providing external services, moved laterally across servers using credential-theft tooling, and eventually obtained domain administrator rights. As in many targeted ransomware cases, encryption was not the first step: the attacker cleaned out backup jobs and historical data in the backup storage and deleted shadow copies, and only then deployed the encryptor overnight.

The next working morning the OA login page would not open, documents across several file server shares were encrypted with ransom notes alongside them, and the desktop wallpaper had been replaced. Only when IT tried to restore did they find the backup repository emptied and no recent restore point available. The organization had to report to its supervising authority while responding, and prepare material for a police filing.

When backups are gone there is no shortcut: every possible data source has to be inventoried and then ranked by feasibility.

• Containment and scoping. Affected servers were disconnected from the internet, domain controllers isolated, suspicious accounts disabled and all privileged domain credentials rotated, so that recovery could not be re-encrypted mid-flight.
• Forensics first. Because a police filing and a report to the supervising authority were required, acquisition preceded cleanup: domain controller security logs, backup server operation logs, edge device and VPN logs, plus hashed disk and memory images of key hosts.
• Source inventory. Item by item: storage-layer snapshots on the network storage (partly retained, untouched by deletions performed at the backup software layer); a set of offline tape media supplied years earlier with the hardware and still in rotation; local caches and offline document copies on end-user machines; and the OA database's log files.
• Layered recovery. Storage snapshots restored most file server shares; the OA database was rebuilt from partially intact data files plus log replay; offline media filled in historical archives; and remaining documents were re-collected from endpoint caches and mail attachments.
• Support for the filing. A forensic report with the timeline, entry-point determination, compromised asset inventory and indicators of compromise was delivered and submitted with the organization's police report.