Context: Profile of the Attacked Company
TransLog (name changed) is a mid-sized Polish logistics company:
- 250 employees, 180 vehicles (TIR trucks, delivery vans)
- TMS system (on-premise, custom), WMS (cloud), GPS telematics
- 3 warehouses (Warsaw, Katowice, Gdansk)
- 45 transport subcontractors
- Revenue: EUR 28 million/year
- IT department: 4 people (admin, developer, helpdesk x2)
- No dedicated SOC or CISO
Day 0: Phishing — Entry Point
Monday, 8:30 AM. A freight forwarding department employee receives an email:
From: orders@translog-partner.pl (spoofed domain) Subject: Urgent — delivery terms change order #TL-28947 Attachment: Amendment_order_TL-28947.xlsx
The email looks professional — it contains a known client’s logo, an order number that exists in the system (extracted from LinkedIn/company website), and proper language.
The employee opens the Excel attachment with a macro. The macro launches a PowerShell downloader that retrieves a Cobalt Strike beacon. Antivirus does not detect it — the payload is custom, generated that same day.
The attacker gains access to the workstation with regular user permissions.
Days 0-2: Reconnaissance and Escalation
The Cobalt Strike beacon establishes a connection with C2 (command & control) over HTTPS — traffic looks like normal web browsing.
The attacker conducts reconnaissance:
- Maps Active Directory — 250 accounts, 4 domain admins
- Discovers the TMS server (Windows Server 2019, SQL Server)
- Identifies cloud WMS (Azure, SSO through AD)
- Finds network shares with customer data and billing information
- Discovers that the IT admin uses the same password for AD and TMS
Privilege escalation: PrintNightmare exploit (unpatched) grants SYSTEM privileges. From the lsass process memory, the domain admin password hash is extracted.
Day 2, 10:00 PM — the attacker has full Active Directory access as Domain Admin.
Days 3-5: Lateral Movement and Exfiltration
Day 3:
- TMS server access — database copying (customer data, rates, routes, 45,000 records)
- Network share access — invoices, contracts, driver personal data
- SSO account takeover → cloud WMS access
Day 4:
- Data exfiltration: 85 GB of data exfiltrated through an encrypted channel to attacker servers
- Data includes: customer database, rates, driver data (national IDs, driver’s licenses), subcontractor agreements
- Attacker modifies Group Policy to disable Windows Defender and Volume Shadow Copies on all machines
Day 5:
- Backdoor installation on 5 servers
- Ransomware deployment test on one staging server (confirming encryption works)
- Preparation of automated deployment script for all servers and workstations
Day 6, Saturday 2:00 AM — Ransomware Attack
Saturday night — minimal IT staff. The attacker launches ransomware (LockBit variant):
Encrypted:
- TMS server (database, configuration, history)
- 3 file servers (documents, invoices, contracts)
- Active Directory Domain Controller
- 180 workstations
- Backup server (NAS connected to network — encrypted along with backups!)
Not encrypted (by chance):
- Cloud WMS (Azure, separate credentials — but attacker has a data copy)
- Telematics systems (separate network, no AD integration)
- Katowice and Gdansk warehouse servers (separate VLANs, but this is luck, not planning)
Ransom note:
TransLog — we have 85 GB of your data. Payment: 15 BTC (approx. EUR 1.05 million) within 72 hours. After the deadline, data will be published. Sample: [link to 50 client invoices]
Monday Morning: Operational Chaos
Operations paralysis:
- TMS unavailable — unable to plan transports
- 180 vehicles in transit without order updates
- Drivers calling helpdesk — system is down
- 3 warehouses partially operational (WMS works, but no orders from TMS)
Crisis response:
- IT admin attempts backup restoration — backup encrypted
- Management learns about the attack from customers (data sample publication)
- Forensics firm called (nFlo)
- Notification to CERT and supervisory authority (72h GDPR)
Emergency solution:
- Dispatcher plans routes manually (Excel + phone)
- Drivers receive orders via SMS
- Warehouses operate on paper documents
- Operational efficiency: 30% of normal
Analysis: What Went Wrong
| Vulnerability | Impact | Prevention |
|---|---|---|
| No email security (SPF/DKIM/DMARC) | Phishing got through | Email security config + awareness |
| Unpatched PrintNightmare | Privilege escalation | Regular patching + vulnerability management |
| Same admin password on AD and TMS | Lateral movement | Separate passwords, MFA, PAM |
| Network-connected backup (NAS) | Backup loss | Air-gapped/immutable backup |
| No IT/TMS segmentation | Ransomware encrypts TMS | Network segmentation, internal firewall |
| No SOC/EDR | No detection for 6 days | 24/7 SOC, EDR on endpoints |
Consequences and Costs
Financial (total ~EUR 1.2 million):
- Ransom: not paid (management decision)
- Forensics and incident response: EUR 82,000
- Infrastructure rebuilding: EUR 190,000
- Lost revenue (2 weeks downtime): EUR 580,000
- Contractual penalties from clients: EUR 140,000
- Supervisory authority fine (GDPR): EUR 120,000
- Identity monitoring for 45,000 individuals: EUR 105,000
Operational:
- 14 days in emergency mode (30% efficiency)
- 4 weeks to full TMS restoration
- 3 clients terminated contracts
- 12 subcontractors demanded explanations and audits
Reputational:
- Client data published on dark web
- Articles in industry media
- Loss of partner and customer trust
Cybersecurity for Your Industry
Learn more about cybersecurity in your industry:
