head-in-the-cloud-2026.pdf

Transcript

1. Ransomware, Reality, and Recovery The Qilin Attack on guenstiger.de
2. MY SELF linkedin.com/in/torben-mallwitz torben.mallwitz@guenstiger.de icons: Flaticon.com
3. THE RANSONWARE icons: Flaticon.com • Ransomware as a Service – attacks executed on behalf of others • Targeting enterprises – high-value victims • Encrypting data – operations brought to a halt • Leaking stolen information – pressure to pay increases
4. THE COMPANY icons: Flaticon.com Germany Hungary Latvia 4 2 1 Domains: Employees: Germany India ~ 45 ~ 65
5. UI Backoffice Platform icons: Flaticon.com
6. THE BEGINNING icons: Flaticon.com It all began with a call
7. icons: Flaticon.com UI Backoffice Platform
8. THE BEGINNING icons: Flaticon.com It all began with a call Datacenter Check
9. icons: Flaticon.com UI Backoffice Platform
10. THE BEGINNING icons: Flaticon.com It all began with a call Datacenter Check Start building the rescue system Send teams home
11. THE BEGINNING icons: Flaticon.com Central cybercrime contact point (ZAC service) Notification of a personal data breach Engage external incident response team Conduct forensic analysis
12. THE BEGINNING icons: Flaticon.com Duration: 1 Day My Role: Decision maker • Isolate systems – keep them powered on • Document everything from the first minute – what, when, and by whom • Major issue – too big to handle alone; ask for help early • Focus on the servers – they are what matters; Clients are collateral
13. THE CHAOS icons: Flaticon.com Order and install New Firewall Establish a clean network
14. icons: Flaticon.com UI Backoffice Platform
15. THE CHAOS icons: Flaticon.com Order and install New Firewall Establish a clean network Buy a lot USB Drives To pay or not to pay?
16. THE CHAOS icons: Flaticon.com Duration: 2 weeks My Role: Communication Hub • Everything happens at once – stay calm • Make it visible – whiteboard with status in a central place • Send updates to everyone – even when there’s nothing new to report. • Take care of your people – food, drinks, and well-being matter
17. THE REBUILD icons: Flaticon.com Define new rules Structure and planning Improve the system Ensure payments work
18. THE REBUILD icons: Flaticon.com Duration: 2 weeks My Role: Coordinator • The change is hard to notice – stay alert • Plan the sequence carefully – not everything is equally important • You have the chance to improve – it won’t come again • External support would have helped – consider it
19. THE RETURN icons: Flaticon.com Share information about the new setup Work from home Order and install New Laptops Hey, where is my tool?
20. THE RETURN icons: Flaticon.com Duration: till now My Role: Explainer • Manage expectations – focus on system recovery first • More safety – less comfort • No more BYOD – security comes first • Celebrate recovery – host a “back to office” party
21. THE RETURN icons: Flaticon.com
22. THE END icons: Flaticon.com Ransomware is technical Recovery is human