Industry solution
Logistics and Supply Chain Ransomware Response
Logistics is acutely time-sensitive: when TMS, WMS, dispatch and sorting systems stop, goods pile up in warehouses and on routes immediately, and the effect propagates up and down the supply chain. This page covers the sector's threat profile, a recovery order built around goods movement, and hardening for EDI-interconnected environments.
Critical business systems
- TMS transport management and dispatch systems
- WMS warehouse management and sortation control systems
- Order and waybill management, and customer ordering portals
- GPS fleet monitoring and in-vehicle terminal platforms
- EDI / API interfaces and upstream-downstream data exchange
- Billing, settlement and reconciliation systems
- Sortation equipment workstations and automation control systems
- Core databases, virtualization platforms and warehouse-local servers
Threat landscape
Logistics networks have two defining traits: dispersed sites and dense external interconnection. Warehouses, transit hubs and branch offices nationwide connect back to head office systems, while exchanging data with shippers, carriers, platforms, customs and financial institutions. That extends the attack surface inward and outward at once.
Principal risk points:
- Weak local IT at warehouses and branches. Sites typically run local servers, sortation workstations and print servers maintained casually by on-site staff, with patching and security software lagging — a common breach point.
- High demand for remote access. Drivers, field staff, carriers and equipment vendors all need system access, and remote channels opened for them with weak authentication get used directly. Public reporting indicates RDP brute force and vulnerability exploitation together account for close to 80% of ransomware delivery in China.
- Numerous external interfaces. EDI, API and FTP counterparties are many and heterogeneous, and interface hosts often run for years on old versions — ready entry points or lateral stepping stones.
- Automation equipment cannot be stopped or patched freely. Sortation line workstations are tied to specific system versions, upgrades disrupt operations, and they remain on old builds.
- Time pressure compresses the handling window. Logistics cannot wait, management wants immediate restoration, and that pressure breeds the mistake of going live before eradication.
Business impact
- Goods back up immediately. Waybills cannot be generated, vehicles and routes cannot be assigned, and picking cannot proceed, so warehouses and hubs fill rapidly, consuming space and labour — and the backlog surge still has to be worked through after recovery.
- Missed service levels and claims. E-commerce parcels, cold chain, pharmaceuticals and fresh produce carry hard timing requirements, and delays trigger compensation clauses, customer claims and platform penalties.
- Upstream and downstream knock-on. As a link in the supply chain, your outage disrupts shippers' production and sales plans, potentially triggering supplier reviews and contractual accountability.
- Risk to waybill and billing data. Missing waybill, delivery confirmation, rating and settlement data makes reconciliation with customers and carriers difficult and pushes settlement cycles back.
- Operations fall back to paper. Sortation, goods movement and delivery confirmation move to manual records — slower and error-prone — requiring extensive back-entry and stocktaking afterwards.
- Exposure of customer and commercial data. Shipper details, sender and recipient information, rates and contract terms are sensitive, and exposure under double extortion damages commercial relationships.
Our response plan
Contain and switch operations to manual
Technically, contain quickly by site and segment, cut potential spread paths between head office, warehouses and branches, and pause EDI and interface jobs so the problem is not propagated to counterparties. Operationally, switch to manual procedures immediately: paper waybills and handover notes, manual sortation and loading records, and a temporary customer communication channel. In parallel, image core databases, TMS / WMS servers and warehouse-local servers read-only and preserve their logs.
Identify the family and sweep dispersed sites
While establishing the family and encryption mode, the sweep must cover every site: warehouse-local servers, sortation workstations, branch endpoints, and hosts driving printing and weighing equipment. The most common misjudgement in logistics is to examine the head office data centre and miss a compromised host still running in one warehouse. Check external interface hosts and remote access channels too, to confirm the entry point and whether partners have been affected through an EDI link.
Prioritise recovery along the goods flow
A workable order: first tier — identity and network infrastructure, waybill and order systems, WMS receiving and picking, and TMS dispatch and load planning, so goods can move again; second tier — GPS monitoring, customer portals and tracking, billing, and EDI interfaces; third tier — settlement reconciliation, historical data and analytics. Agree a backlog plan at the same time: handle time-sensitive and high-value shipments first, and communicate revised delivery expectations to customers.
Recover and reconcile waybills against inventory
Recover in a clean environment, validate on an isolated segment, then bring systems back in batches. Acceptance reconciles in two directions: system data against physical reality (stocktake of goods on hand, status of goods in transit, the pending dispatch list), and system data against external records (customer system orders, carrier waybills, platform and customs data, delivery receipts). Paper records from the manual period are entered chronologically after recovery and aligned with the stocktake results.
Segment sites, govern interfaces, and sign off
Hardening priorities: site segmentation (boundaries and access control between warehouses, branches and the head office data centre, with warehouse-local environments unable to reach core systems directly); interface governance (an inventory of EDI / API / FTP counterparties, with interface hosts deployed separately under least privilege, audited and patched regularly); and consolidated remote access (drivers, field staff, carriers and equipment vendors all entering through an authenticated channel and jump host). Rebuild the backup estate with offline or immutable copies, complete a real restore drill, and deliver the report and remediation plan.
Common ransomware families
- Some versions decryptable
LockBit
LockBit is one of the largest ransomware-as-a-service operations in the world. Despite the 2024 law-enforcement takedown it returned as LockBit 5.0, with working Windows, Linux and VMware ESXi payloads, and it remains one of the most frequently seen families in China.
- Some versions decryptable
Akira
Akira is a ransomware-as-a-service operation that emerged in March 2023, breaking in through VPNs without MFA and edge-device flaws, then encrypting Windows estates and VMware ESXi clusters under double extortion. CISA's November 2025 advisory update calls it an imminent threat to critical infrastructure.
- No public decryptor
Play
Play (PlayCrypt / Balloonfly) has been active since June 2022 and is one of the few closed-group ransomware operations, recompiling its encryptor for every victim. It targets FortiOS and Exchange flaws, RDP and VPN, and maintains a dedicated ESXi encryptor. CISA counted roughly 900 victims as of May 2025, and public leak-site trackers list over 1,200 entries as of September 2026.
- Some versions decryptable
Mallox
Mallox (also known as TargetCompany) breaks in mainly through brute-forced MS SQL Server credentials, targets database servers specifically, and has a Linux/ESXi variant. Files encrypted between 2023 and early 2024 may be decryptable with Avast's free tool; later builds have no public decryption method.
- Free decryptor available
Phobos
Phobos is a RaaS family that relies mainly on brute-forced RDP and has spawned a long list of variants (.eking, .faust, .elbie, .devos and more). It has been a persistent presence in Chinese server-ransomware cases, and in July 2025 Japan's National Police Agency released a free decryptor covering part of the lineage.
Hardening recommendations
- Bring warehouses and branches into central management. Local servers, sortation workstations, and printing and weighing hosts all belong in a unified asset register with managed patching and policy, rather than being maintained ad hoc by site staff.
- Segment sites from head office. Warehouses and branches must not reach the core data centre directly, and cross-zone access should traverse a controlled channel, so one compromised site does not mean a compromised estate.
- Consolidate remote access behind strong authentication. Remove internet-facing RDP; route drivers, field staff, carriers and equipment vendors through VPN or a zero-trust gateway with MFA, and vendor maintenance through a jump host with on-demand authorisation.
- Govern external interfaces from an inventory. Enumerate every EDI / API / FTP counterparty and interface host, deploy interface services separately under least-privilege accounts with log retention and regular audit, and decommission dormant connections.
- Compensating controls for automation workstations. Sortation hosts that cannot be patched need network isolation, access whitelisting, removable media control and single-purpose use.
- Back up waybill and billing data specifically. Store database backups separately with an offline or immutable copy, include warehouse-local system data in scope, and run a real restore drill quarterly.
- Prepare manual operation and backlog playbooks. Paper waybill templates, manual sortation procedures, the customer communication line, and the back-entry and stocktake rules for after recovery should be defined and rehearsed in advance.
- Deploy EDR on servers and site endpoints, monitoring precursors such as shadow-copy deletion, mass file rewriting and unusual remote execution, and ensure alerts reach an on-call responder at night and on holidays.
Emergency response
Data already encrypted? Stop and let an engineer look first
We do not pay ransoms and we do not negotiate with attackers. Engineers run a free assessment first, then propose a recovery plan and a firm quote.
Related scenarios
SQL Server Database Encrypted by Ransomware
When SQL Server .mdf / .ldf files are encrypted, the ERP and inventory systems built on them — Yonyou U8, Kingdee K/3, Guanjiapo, Suda — stop completely. This page covers evidence handling, how we judge whether page-level repair is viable, and the conditions for backup-plus-log restore.
ERP System Encrypted by Ransomware
An encrypted ERP is not a single broken database: the application tier, database, attachments and interfaces fail together, halting finance, procurement, production and inventory. This page covers the vulnerability entry points seen in Chinese ERP deployments, the order in which the four tiers are recovered, and how account sets are reconciled at sign-off.
ESXi / Hyper-V Virtualization Encrypted by Ransomware
Hypervisor-level encryption causes the widest blast radius of any ransomware event: dozens of production VMs go dark within an hour or two. This page covers what Linux ESXi encryptors actually do — shut down guests, encrypt vmdk, delete snapshots — the recovery value of flat disk files, and how Hyper-V and Proxmox cases differ.
File Servers and NAS Encrypted by Ransomware
When shared folders on a file server or NAS are encrypted, drawings, contracts, archives, quotations and design sources all become unusable at once — and mapped drives spread the impact to every endpoint. This page covers how to gauge spread, what shadow copies and snapshots realistically offer, and how to sequence recovery by business value.
Backups Deleted or Destroyed
Modern ransomware follows a fixed sequence: destroy the backups, then encrypt the data — deleting shadow copies, encrypting repositories, disabling jobs, and exploiting backup software flaws to steal credentials. This page covers what can still be inventoried once backups fail, why replication propagates encrypted files off-site, and what offline and immutable copies are really worth.
Related services
Incident Response
Round-the-clock intake: contain first, preserve evidence second, recover third.
Data Recovery
Recovery beyond decryption: backup repair, database repair and remnant extraction.
Security Hardening
Close the handful of paths attackers actually use: exposure, weak credentials, patches, privilege, backups.
Attack Forensics & Attribution
Establish the intrusion path, timeline and impact — in a report usable for police reporting and compliance.
FAQ
Frequently asked questions
TMS / WMS is down and goods are piling up — what do we do?
Run two tracks in parallel. Operationally, switch to manual immediately: paper waybills and handover notes, manual sortation and loading by zone, priority for time-sensitive and high-value shipments, revised delivery expectations communicated to customers, and closure of intake you cannot accept. Technically, recover along the goods flow: waybill and order systems, then WMS receiving and picking, then TMS dispatch and load planning, then everything else. Afterwards, enter the paper records from the manual period and run a physical stocktake to correct on-hand and in-transit data.
We have EDI links with customers — could they be affected?
It must be assessed seriously, and counterparties should be notified early in the response. Two risks exist: the interface host being used as a route into the partner's network, and anomalous or contaminated data being transmitted over the link. Actions include pausing EDI and API jobs, checking whether interface hosts were compromised, reviewing recently transmitted data for anomalies, rotating interface credentials and certificates where warranted, and sharing the assessment with the partner's security team. As a link in a supply chain, proactive notification usually serves you better than being discovered later.
One warehouse is still running — does that mean it was unaffected?
Do not assume that. Deployment may have been staged, or a host may simply have been offline at the time; more often the site is already compromised but has not yet had the encryptor run, or still holds the attacker's backdoors and persistence. The correct approach is to bring every site into the sweep: check for rogue accounts, scheduled tasks, services, suspicious processes and outbound connections, and confirm cleanliness before continued use. Until that is done, network access between the site and head office should also be restricted.
We lost a window of waybill and billing data — how do we reconcile with customers?
Logistics has the advantage that records usually exist with several parties. Sources for backfill include order and dispatch records in customer systems, waybill data from carriers and parcel companies, platform and customs declarations, delivery receipts and electronic proof of delivery, trip data from GPS and in-vehicle terminals, and the paper documents from the manual period. Our recovery plan lists the source and priority for each data type; afterwards we reconcile source by source, log discrepancies with their causes, and agree the settlement basis with customers so nothing is billed twice or missed.
Sortation workstations cannot be stopped for patching — how do we protect them?
Substitute network and usage controls for upgrades. Concretely: place the workstations on a dedicated segment with only the ports needed to reach controllers and essential business systems; whitelist the destinations they may contact; forbid web browsing, email and office use so they stay single-purpose; tightly control removable media; and bring them into the asset register and monitoring scope so anomalous communication is detected. Agree the design with the equipment vendor, so operational stability and warranty terms are not affected.
Updated