DFIR Case Study: How an Australian Accounting Firm Survived a Vendor-Borne Ransomware Attack — An Incident Response Walkthrough

---

The Scenario: A Composite Australian SMB Breach

Firm profile: A 75-staff accounting practice in Melbourne, handling sensitive financial data for approximately 600 SME clients. Microsoft 365 environment, hybrid Active Directory with Azure AD Connect, servers hosted on-premises, outsourced IT support through a managed services provider (MSP). The MSP uses ScreenConnect (ConnectWise Control) for remote support.

Attacker profile (composite): A financially motivated threat group — loosely modelled on observed tactics from KRYBIT ransomware operations and APT28 DNS hijacking campaigns — targeting Australian professional services firms via third-party access pathways [1].​‌‌​​‌​​‍​‌‌​​‌‌​‍​‌‌​‌​​‌‍​‌‌‌​​‌​‍​​‌​‌‌​‌‍​‌‌​​​‌‌‍​‌‌​​​

​‌‍​‌‌‌​​‌‌‍​‌‌​​‌​‌‍​​‌​‌‌​‌‍​‌‌‌​​‌‌‍​‌‌‌​‌​​‍​‌‌‌​‌​‌‍​‌‌​​‌​​‍​‌‌‌‌​​‌‍​​‌​‌‌​‌‍​‌‌‌​​‌​‍​‌‌​​​​‌‍​‌‌​‌‌‌​‍​‌‌‌​​‌‌‍​‌‌​‌‌‌‌‍​‌‌​‌‌​‌‍​‌‌‌​‌‌‌‍​‌‌​​​​‌‍​‌‌‌​​‌​‍​‌‌​​‌​‌‍​​‌​‌‌​‌‍​‌‌‌​‌‌​‍​‌‌​‌​​‌‍​‌‌​​​​‌‍​​‌​‌‌​‌‍​‌‌​​​‌‌‍​‌‌​‌‌‌‌‍​‌‌​‌‌​‌‍​‌‌‌​​​​‍​‌‌‌​​‌​‍​‌‌​‌‌‌‌‍​‌‌​‌‌​‌‍​‌‌​‌​​‌‍​‌‌‌​​‌‌‍​‌‌​​‌​‌‍​‌‌​​‌​​‍​​‌​‌‌​‌‍​‌‌‌​‌‌​‍​‌‌​​‌​‌‍​‌‌​‌‌‌​‍​‌‌​​‌​​‍​‌‌​‌‌‌‌‍​‌‌‌​​‌​‍​​‌​‌‌​‌‍​‌‌​‌​​‌‍​‌‌‌​​‌​‍​​‌​‌‌​‌‍​‌‌‌​​​​‍​‌‌​‌‌​​‍​‌‌​​​​‌‍​‌‌‌‌​​‌‍​‌‌​​​‌​‍​‌‌​‌‌‌‌‍​‌‌​‌‌‌‌‍​‌‌​‌​‌‌

Initial access vector: The MSP's ScreenConnect instance was compromised through a credential-stuffing attack against an administrator account that lacked multi-factor authentication. The attacker used the RMM tool to push a PowerShell script to 14 endpoints across the accounting firm's network, deploying Cobalt Strike beacons for persistence and lateral movement.

---

Stage 1: Detection — The First 30 Minutes

Alert trigger: At 03:14 AEST, the firm's EDR platform (Microsoft Defender for Endpoint) generated a high-severity alert: "Suspicious PowerShell execution — encoded command detected on FINANCE-SRV-02."

Artefacts pulled by the analyst:

Artefact	Source	What It Showed
Alert timeline	Defender XDR portal	Encoded PowerShell spawning from ScreenConnect.Service.exe at 03:12 AEST
Process tree	Defender Advanced Hunting (DeviceProcessEvents)	Parent process chain: ScreenConnect.Service.exe → powershell.exe -EncodedCommand SQBFAFgAIAAoAE4AZQB3AC0ATwBiAGoAZQBjAHQAIABOAGUAdAAuAFcAZQBiAEMAbABpAGUAbgB0ACkALgBEAG8AdwBuAGwAbwBhAGQAUwB0AHIAaQBuAGcAKAAnAGgAdAB0AHAAOgAvAC8...
Network connection logs	Defender DeviceNetworkEvents	Outbound HTTPS connection to known C2 infrastructure on port 443
Scheduled task creation	Windows Event ID 4698	New scheduled task WindowsUpdateCheck created — persistence mechanism

The analyst immediately declared a Priority 1 incident and paged the incident response team. The 03:14 timestamp was critical — the attack launched at 3 AM, the classic "low-observation window" used by ransomware operators targeting Australian businesses [2].

---

Stage 2: Triage — Scoping the Blast Radius

Objective: Determine how far the attacker moved, what was accessed, and whether data exfiltration occurred before encryption.

Artefacts pulled:

Artefact	Source	Finding
Entra ID sign-in logs	Azure AD / Entra admin center → Sign-in logs	Anomalous login from IP 103.224.182[.]253 (Thailand) at 03:47 AEST using a Domain Admin account (svc_backup) — lateral movement to cloud
M365 Unified Audit Log	Purview Compliance portal → Audit search	MailItemsAccessed operation on the CFO's mailbox at 03:52 AEST — 847 items accessed in 90 seconds
DNS query logs	Internal DNS server (Windows Event ID 3008 for DNS query logging)	High volume of TXT queries to ns1.exfil-malik[.]xyz — DNS tunnelling for data exfiltration
NetFlow / firewall logs	FortiGate traffic logs	2.3 GB outbound to TCP/443 to IP 185.244.25[.]187 between 03:30–04:10 AEST
RDP connection logs	Windows Event ID 4624 (Type 10)	RDP sessions from FINANCE-SRV-02 to 6 other servers between 03:25–04:00 AEST

Triage summary: The attacker moved laterally to 6 servers, accessed the CFO's mailbox, and exfiltrated approximately 2.3 GB of data — likely client tax files, BAS statements, and payroll records — before triggering encryption.

---

Stage 3: Containment — Stopping the Bleed

Actions taken (04:15–04:45 AEST):

1. Network isolation: Disabled the VLAN for all affected servers at the switch level. The SOC analyst called the on-call network engineer and had them apply ACLs blocking all outbound traffic from the server subnet except to the EDR cloud console and the backup infrastructure.

2. Identity containment: Disabled the compromised service accounts (svc_backup, svc_connectwise) in Active Directory. Revoked all active Entra ID refresh tokens via the Revoke-AzureADUserAllRefreshToken PowerShell cmdlet.

3. MFA enforcement: The MSP was instructed to immediately enable MFA on all their technician accounts — this was done within 12 minutes via a conditional access policy pushed through their RMM platform.

4. EDR host isolation: Applied network isolation via Defender for Endpoint to all 14 affected endpoints, blocking all inbound and outbound connections except to the Defender cloud service.

Key decision point: The IR team chose not to shut down the domain controllers. The attacker had Domain Admin, but the EDR telemetry showed no evidence of DC compromise (no NTDS.dit access, no DCSync replication events). Shutting down DCs would have crippled authentication for the containment effort. The risk was accepted and monitored.

---

Stage 4: Eradication — Removing the Attacker

Actions taken (04:45–08:00 AEST):

1. Persistence removal: Deleted the WindowsUpdateCheck scheduled tasks across all 14 endpoints. Removed the Cobalt Strike service entries from registry (HKLM\SYSTEM\CurrentControlSet\Services\). Verified with a KQL query across all machines:

   DeviceRegistryEvents
   | where ActionType == "RegistryValueSet"
   | where RegistryKey contains "WindowsUpdateCheck"

2. Credential rotation: Emergency password reset for all Domain Admin and service accounts. The MSP rotated their ScreenConnect API keys and revoked all existing session tokens.

3. M365 tenant hardening: Blocked legacy authentication protocols (IMAP, POP3, ActiveSync) via authentication policies. Enabled mailbox auditing for all users (it was previously only enabled for a subset).

4. MSP's environment: The MSP conducted their own investigation and found the ScreenConnect admin account was using Summer2024! — a credential present in the Have I Been Pwned database since November 2024 [3].

5. Reimage decision: All 14 affected servers were reimaged from known-good base images rather than attempting manual clean-up. The decision was made at 05:30 AEST and executed in parallel by the IR team.

---

Stage 5: Recovery — Business Restoration

Actions taken (08:00–14:00 AEST):

1. Restore from backup: The firm maintained Veeam backups with immutable storage on a Linux hardened repository. The encryption event occurred at 04:05 AEST — the last clean backup was at 01:00 AEST. Restore commenced at 08:30 AEST.

2. Verification before reconnection: Each restored server was scanned with Defender for Endpoint and manually verified (no unauthorised scheduled tasks, no unexpected outbound connections) before being reconnected to the network.

3. Client notification: The firm's managing partner briefed their professional indemnity insurer and the Australian Cyber Security Centre (ACSC) via ReportCyber. Client notifications were drafted with legal counsel — the OAIC Notifiable Data Breach scheme applied because tax file numbers and financial data were exfiltrated [4].

4. Service restoration timeline: Core financial systems operational by 11:30 AEST. Full client-facing services restored by 14:00 AEST. Total downtime: approximately 11 hours.

---

Stage 6: Lessons Learned — What the Post-Incident Review Found

1. The MSP was the single point of failure. The firm had no visibility into the MSP's security posture — no contractual requirement for MFA, no quarterly access reviews, no audit of third-party remote access logs.

2. Service accounts ran with excessive privileges. The svc_backup account had Domain Admin rights — it only needed backup operator and Exchange admin roles. This allowed the attacker to pivot from the server layer to the M365 tenant without additional privilege escalation.

3. DNS logs were not being centrally collected. The DNS tunnelling exfiltration ran for 40 minutes before detection. If DNS query logs had been fed into the SIEM with anomaly detection (high TXT query volume, queries to newly registered domains), the exfiltration could have been detected within 5 minutes.

---

FAQ

Conclusion

This incident was recoverable because the firm had three things working in their favour: a properly configured EDR that detected the PowerShell execution within 2 minutes, immutable backups that survived the encryption event, and an IR team that made fast, evidence-based containment decisions. Three preventive controls would have stopped this attack at its earliest stage:

1. MFA on all third-party access (including MSP RMM tools) — blocks credential-stuffing entirely.
2. Application allowlisting (AppLocker or WDAC) on all servers — prevents unsigned PowerShell execution, even from trusted parent processes.
3. Immutable, offline backup verification with monthly restoration drills — ensures recovery capability independent of the attack path.

For SMBs without a dedicated SecOps team, these three controls deliver the highest risk reduction per dollar spent. Your MSP's security posture is your security posture — govern it accordingly.

Protect your business before the 3 AM call comes. Visit consult.lil.business for a free 30-minute cybersecurity assessment tailored to Australian SMBs.

---

References

1. CYFIRMA Weekly Intelligence Report — KRYBIT Ransomware Analysis (May 2026)
2. Core Managed — Cybersecurity News Fatigue: Which Threats Actually Matter for SMBs (March 2026)
3. LinkedIn — Judah Eckstein: Weekly Cybersecurity Roundup — September 2025: Threats, Incidents, SMB Focus
4. Australian Cyber Security Centre — Essential Eight Maturity Model
5. The Cyber Express — Weekly Roundup: APT28 DNS Hijacking, State-Backed Threats (April 2026)