GlobeImposter encrypts a retail chain's POS and member databases

The client is a regional retail chain operating dozens of stores across several cities. Store POS checkout, member points and head-office inventory share one SQL Server instance in the head-office server room, with the transaction, member and product catalogue databases on a single Windows server.

So that an outsourced operations provider could handle store issues remotely, this server and an adjacent reporting server had port 3389 mapped to the internet long-term, and one administrator password was reused across head-office servers, in-store servers and some POS terminals. Backups were written by a scheduled task to a file server in the same room, using the same domain credentials.

On a weekend night, stores began reporting that registers could not settle online and that member phone numbers returned no points. Head office found the SQL Server service stopped, the .mdf and .ldf files in the data directory and the .bak files in the backup directory all carrying an .Ares666 extension, and a how_to_back_files.html note in every directory that opened in a browser as a ransom page offering a primary and a backup anonymous mailbox and asking for a machine ID. Shadow copies had been cleared and the file-server backups were encrypted as well.

Before calling us, the client had restarted the database service once and run full antivirus scans on some in-store servers.

Containment went out on the first call: keep servers powered but off the network, halt all database and backup writes, switch stores to offline register mode, and attempt no reinstall or repair command against the suspect databases.

• Evidence and imaging. Read-only images of the database, reporting and backup servers, plus security log 4625/4624 records, SQL Server error logs and firewall forwarding rules. All later work ran on copies.
• Family confirmation and recoverability. The .Ares666 extension and how_to_back_files.html note identified GlobeImposter's Olympian-gods (666) series: RSA-2048 protects the keys, no public decryptor exists, and Emsisoft's early tool covers only .crypt variants. Entropy analysis showed this build had overwritten only the header and certain regions of the large .mdf files, leaving many intact pages through the middle and tail.
• Recovery. Page-level scanning rebuilt system tables and allocation structures, then extracted transaction details, member records and price tables into a fresh instance. Local transaction caches and receipt journals from store POS terminals were replayed by trading day to fill the sales records, reconciled against payment-channel statements.
• Hardening in parallel. All public 3389 mappings were removed and remote maintenance moved to VPN with multi-factor authentication; privileged passwords were reset from a clean host, the shared administrator password was retired, and the head-office, store and backup segments were isolated from one another.
• Deliverables. An investigation report, an inventory of affected hosts and data, the member-data exposure assessment and a hardening sign-off checklist.