The week before Christmas, in the early hours of Christmas Day, a security system detected something unusual. A desktop device inside a company’s network had been compromised. Then the attackers moved laterally, reaching two domain controllers. The controllers began making suspicious connections to endpoints linked to known ransomware operations.
The security platform alerted at every stage. Every lateral movement. Every suspicious connection. Every indicator of compromise.
No one acted.
“Although the system had alerted to this activity at every stage,” the security company later reported, “the security team was under great stress during the December period and did not manage to action even these highly critical alerts.”*
The attackers waited. On Christmas Eve, after business hours, the threat re-emerged. Suspicious executables were written. Data was exfiltrated. And in the early hours of Christmas Day, while most employees were offline opening presents with their families, the ransomware payload executed.
The alerts had done their job. The coverage gap turned a detected threat into a full-scale breach.
How would your team manage this situation? Take The 3 AM Test
Read more “The Early AM Alert No One Answered: A Christmas Day Ransomware Attack”
