Earlier this 12 months, analysts within the AT&T Cybersecurity Managed Risk Detection and Response (MTDR) safety operations middle (SOC) have been alerted to a possible ransomware assault on a big municipal buyer. The assault, which was subsequently discovered to have been carried out by members of the Royal ransomware group, affected a number of departments and quickly disrupted important communications and IT techniques.
Throughout the incident, AT&T analysts served as important first responders, promptly investigating alarms within the USM Wherever platform and shortly speaking the difficulty to the client. In addition they supplied intensive after-hours assist on the peak of the assault—because the buyer shared updates on impacted servers and companies, the analysts gave steerage on containment and remediation. They shared all noticed indicators of compromise (IOCs) with the client, a few of which included IP addresses and domains that could possibly be blocked shortly by the AT&T Managed Firewall staff as a result of the client was additionally utilizing AT&T’s managed firewall companies.
Simply 24 hours after preliminary communications, analysts had compiled and delivered to the client an in depth report on the incident findings. The report included suggestions on learn how to assist shield in opposition to future ransomware assaults in addition to urged remediation actions the client ought to take within the occasion that authorized, compliance, or deeper post-incident forensic evaluation is required.
Learn our case examine to study extra about how our analysts helped the client speed up their time to reply and comprise the injury from the assault, and learn the way the AT&T Alien Labs menace intelligence staff has used the findings from this incident to assist safe all AT&T Cybersecurity managed detection and response clients!
