Executive Summary
In July 2025, ADAMnetworks was engaged by a third-party Incident Response (IR) Commander to assist a client that had suffered a severe cyber breach. The primary goal was rapid business recovery, as previous IR engagements had historically taken too long during the rebuild phase. Over a rapid four-day operation, ADAMnetworks successfully rebuilt the network architecture, isolated threats, safely restored 4TB of core data, and returned the business to full operational capacity, minimizing downtime to just one week.
The Challenge
A business was breached, and the leadership faced immense pressure regarding the future of the company. The CEO of the victim organization noted, “My friends tell me I should just close shop. They say I’ll spend 500k and 3 months later still not be up and running”. The engagement required a dual focus: first, prioritize immediate business recovery, and second, prioritize preservation of the environment for a delayed investigation.
The Response Team
The recovery effort involved a coordinated multi-party team:
- The Exec Team: An internal communication advocate who kept staff, vendors, and clients informed.
- IR Commander (3rd Party): Directed the overall response, supervised cloud account inspections, and maintained communication lines.
- Insurance Provider: A stakeholder highly motivated to reduce lost time and prevent re-infection.
- Technical Team: Led by on-site Technical Lead David Redekop, adam:ONE pro Nick Neufeld, remote technical support from Tavis Wordley, hypervisor support, and the client’s on-premise IT staff.
Execution & Timeline
The strategy involved a multi-day “Rip & Replace” and restore approach:
Day 0 (Preparation)
- ADAMnetworks pre-staged one gateway with a known WAN configuration and prepared a replacement switch.
- Two personnel resources were dedicated to the response.
Day 1 (Containment & Network Restructuring - 10 hours)
- The team arrived on-site and focused on restoring core connectivity while remaining radio silent to the attacker.
- They established trust with the client, securing necessary credentials, and managed expectations by warning that “things will get worse before they get better”.
- Replacement gateways and switches were connected with High Availability (HA) from the start.
- The team eliminated the previous flat network and created five distinct network segments: Management, AD, Users, BYOD, and Guest WiFi.
- They rearchitected the IP Address Management (IPAM) to be entirely gateway-based and upgraded site-to-cloud connections from IPSec to WireGuard for strategic advantages.
Day 2 (Safe Restoration & Discovery - 12 hours)
- The team safely restored the Domain Controller (DC) from a backup into a net-new network segment, operating with confidence that any existing Indicators of Compromise (IOCs) would be unable to establish Command and Control (C2) connections.
- Infected servers were kept in an OFF state.
- A new IP schema was provisioned to utilize the new network segments, and additional Access Points were added to restore segmented WiFi across the facilities.
- During this phase, the team also isolated and booted a pre-ransomed DC snapshot to discover the attacker’s C2 infrastructure.
Day 3 (Endpoint Clearance & Core Functionality - 12 hours)
- On Monday morning as staff returned, the lifeblood of the business was functional, including the restoration of a 4TB MSSQL database and associated files.
- Every returning device was placed into a “Holding Tank Quarantine”.
- A “green-sticker program” was instituted: devices were booted in safe mode, a trial of Webroot was installed, and if no threat was found, a physical green sticker was applied.
- Cleared devices were then tagged in the dashboard, transitioning them to a Zero Trust Client (ZTc) policy.
Day 4 (Fine-Tuning & Resilience Building - 8 hours)
- The team confirmed that all 75 devices and 25 users had their critical functionality fully restored.
- They began building a net-new backup domain controller for improved resilience.
- The Azure tenant was optimized so that all outbound traffic was subjected to a ZTc policy.
- An on-demand user VPN was built using OpenVPN that authenticated via AD as a full tunnel under the ZTc policy, allowing remote operation.
Key Results & Impact
The engagement exceeded stakeholder expectations, combating their initial disbelief at the speed of recovery. The operation yielded the following Key Performance Indicators (KPIs):
- 02 Days: Time taken until the Domain Controller was safely running.
- 04 Days: Total time until all business operations were restored.
- 1 Week: Total lost productivity for the business, preventing months of potential downtime and catastrophic financial losses.
Quote from IT Manager:
“ADAM Networks was indispensable in recovering from a ransomware attack that took down our IT infrastructure. A team of experts came onsite and helped us through a very difficult time and each stage of the way, we felt we were in the best hands possible. Within days we had a new network up, new equipment in place and our staff working in a moderately productive capacity. Once we were fully back, we had the comfort of knowing we no longer had to worry about a second incident with all the added security ADAM provided and that piece of mind was invaluable in our recovery. Our company may not be here today if it wasn’t for the ADAM team and we’re customers for life.”
