TellYouThePass hits a logistics company's ERP server

The client is a regional logistics company whose ERP system offers order placement and carrier lookup to external customers, with the application server and database on one Linux host and a separate Windows host holding scanned waybills and electronic receipts.

Because the business required customers to have round-the-clock access, the ERP web port was exposed directly to the internet, the middleware and business components had received only one minor update since go-live, and the operations team had no patch-tracking process for that system.

One weekday afternoon, customer service reported that clients could not place orders. Operations found the web service returning errors, application directories and database files carrying a uniform appended suffix, and ransom notes in both HTML and text form — the page displaying bilingual Chinese and English text with contact details. The scanned-document directory on the Windows host was encrypted as well.

Worth noting: this kind of incident is usually not targeted. The actor scans the internet at scale, deploys the encryptor automatically on any instance matching a known vulnerability, and the gap between intrusion and encryption is often very short. Company size and industry are not selection criteria.

With automated mass deployment the key insight is that the affected asset is rarely the only one, so the sweep covered every internet-exposed asset from the start.

• Containment and sweep. Public access to the ERP was cut immediately and all outbound port mappings inventoried. Two test hosts were found running the same component version and equally exposed; one already had suspicious processes but had not yet been encrypted, and was isolated in time.
• Evidence. Web access, application and system logs were preserved, and an anomalous request sequence followed by script files written to disk was located just before encryption — the timeline evidence for the entry point.
• Family confirmation. The note format and encryption characteristics identified the Linux build of TellYouThePass, with no usable public decryptor.
• Recovery. A nightly logical backup of the ERP database was written to a separate internal backup host that was not exposed and not affected, and became the primary source. Orders and waybills created during that day were reconstructed from application logs, notification records sent to customers and carriers, and unencrypted temporary exports. Most scanned documents on the Windows host were recovered from unencrypted remnants and historical archives.
• Hardening. Components were upgraded to a supported version, the web port moved behind a reverse proxy with source restrictions, and a patch-tracking inventory established for internet-facing assets.