Context: Profile of the Attacked Company
TransLog (name changed) is a mid-sized Polish logistics company:
- 250 employees, 180 vehicles (TIR trucks, delivery vans)
- TMS system (on-premise, custom), WMS (cloud), GPS telematics
- 3 warehouses (Warsaw, Katowice, Gdansk)
- 45 transport subcontractors
- Revenue: EUR 28 million/year
- IT department: 4 people (admin, developer, helpdesk x2)
- No dedicated SOC or CISO
Day 0: Phishing — Entry Point
Monday, 8:30 AM. A freight forwarding department employee receives an email:
From: orders@translog-partner.pl (spoofed domain) Subject: Urgent — delivery terms change order #TL-28947 Attachment: Amendment_order_TL-28947.xlsx
The email looks professional — it contains a known client’s logo, an order number that exists in the system (extracted from LinkedIn/company website), and proper language.
The employee opens the Excel attachment with a macro. The macro launches a PowerShell downloader that retrieves a Cobalt Strike beacon. Antivirus does not detect it — the payload is custom, generated that same day.
The attacker gains access to the workstation with regular user permissions.
Days 0-2: Reconnaissance and Escalation
The Cobalt Strike beacon establishes a connection with C2 (command & control) over HTTPS — traffic looks like normal web browsing.
The attacker conducts reconnaissance:
- Maps Active Directory — 250 accounts, 4 domain admins
- Discovers the TMS server (Windows Server 2019, SQL Server)
- Identifies cloud WMS (Azure, SSO through AD)
- Finds network shares with customer data and billing information
- Discovers that the IT admin uses the same password for AD and TMS
Privilege escalation: PrintNightmare exploit (unpatched) grants SYSTEM privileges. From the lsass process memory, the domain admin password hash is extracted.
Day 2, 10:00 PM — the attacker has full Active Directory access as Domain Admin.
Days 3-5: Lateral Movement and Exfiltration
Day 3:
- TMS server access — database copying (customer data, rates, routes, 45,000 records)
- Network share access — invoices, contracts, driver personal data
- SSO account takeover → cloud WMS access
Day 4:
- Data exfiltration: 85 GB of data exfiltrated through an encrypted channel to attacker servers
- Data includes: customer database, rates, driver data (national IDs, driver’s licenses), subcontractor agreements
- Attacker modifies Group Policy to disable Windows Defender and Volume Shadow Copies on all machines
Day 5:
- Backdoor installation on 5 servers
- Ransomware deployment test on one staging server (confirming encryption works)
- Preparation of automated deployment script for all servers and workstations
Day 6, Saturday 2:00 AM — Ransomware Attack
Saturday night — minimal IT staff. The attacker launches ransomware (LockBit variant):
Encrypted:
- TMS server (database, configuration, history)
- 3 file servers (documents, invoices, contracts)
- Active Directory Domain Controller
- 180 workstations
- Backup server (NAS connected to network — encrypted along with backups!)
Not encrypted (by chance):
- Cloud WMS (Azure, separate credentials — but attacker has a data copy)
- Telematics systems (separate network, no AD integration)
- Katowice and Gdansk warehouse servers (separate VLANs, but this is luck, not planning)
Ransom note:
TransLog — we have 85 GB of your data. Payment: 15 BTC (approx. EUR 1.05 million) within 72 hours. After the deadline, data will be published. Sample: [link to 50 client invoices]
Monday Morning: Operational Chaos
Operations paralysis:
- TMS unavailable — unable to plan transports
- 180 vehicles in transit without order updates
- Drivers calling helpdesk — system is down
- 3 warehouses partially operational (WMS works, but no orders from TMS)
Crisis response:
- IT admin attempts backup restoration — backup encrypted
- Management learns about the attack from customers (data sample publication)
- Forensics firm called (nFlo)
- Notification to CERT and supervisory authority (72h GDPR)
Emergency solution:
- Dispatcher plans routes manually (Excel + phone)
- Drivers receive orders via SMS
- Warehouses operate on paper documents
- Operational efficiency: 30% of normal
Analysis: What Went Wrong
| Vulnerability | Impact | Prevention |
|---|---|---|
| No email security (SPF/DKIM/DMARC) | Phishing got through | Email security config + awareness |
| Unpatched PrintNightmare | Privilege escalation | Regular patching + vulnerability management |
| Same admin password on AD and TMS | Lateral movement | Separate passwords, MFA, PAM |
| Network-connected backup (NAS) | Backup loss | Air-gapped/immutable backup |
| No IT/TMS segmentation | Ransomware encrypts TMS | Network segmentation, internal firewall |
| No SOC/EDR | No detection for 6 days | 24/7 SOC, EDR on endpoints |
Consequences and Costs
Financial (total ~EUR 1.2 million):
- Ransom: not paid (management decision)
- Forensics and incident response: EUR 82,000
- Infrastructure rebuilding: EUR 190,000
- Lost revenue (2 weeks downtime): EUR 580,000
- Contractual penalties from clients: EUR 140,000
- Supervisory authority fine (GDPR): EUR 120,000
- Identity monitoring for 45,000 individuals: EUR 105,000
Operational:
- 14 days in emergency mode (30% efficiency)
- 4 weeks to full TMS restoration
- 3 clients terminated contracts
- 12 subcontractors demanded explanations and audits
Reputational:
- Client data published on dark web
- Articles in industry media
- Loss of partner and customer trust
Cybersecurity for Your Industry
Learn more about cybersecurity in your industry:
Related services and products
- OT/ICS Ransomware Resilience Testing
- IT System and Infrastructure Configuration Review
- CrowdStrike Falcon Surface (EASM)
Frequently asked questions
Is this scenario realistic?
The scenario is a compilation of techniques from real attacks on logistics companies — NotPetya (Maersk), Port of Nagoya attack (2023), ransomware attacks on TSL companies in Poland and Europe. Every element is based on observed techniques.
How long does it take to restore operations after ransomware?
Depends on preparation. With good backup and DRP plan: 24-72 hours for critical systems. Without backup: 2-6 weeks. NotPetya forced Maersk to fully reinstall its entire IT environment.
Does paying the ransom guarantee data recovery?
No. Even though the vast majority of companies paying ransom recover their data, most of them are attacked again. Additionally, payment funds further attacks and does not guarantee removal of backdoors from the infrastructure.
How to check a logistics company's readiness for a cyberattack?
A professional security audit and penetration testing is the starting point. Tabletop exercises (attack simulation with management) test procedure readiness. A red team engagement tests the team's response to a real attack.
