A Ransomware Week: Identity, Backups, and the Restore Drill You Can

For South African business leaders across Gauteng and the broader African continent, ransomware is no longer an abstract headline. It is an operational eventuality. Too many executive committees evaluate their cyber risk against a passive checklist: a perimeter firewall in the rack, anti-virus on endpoints, and automated cloud backups running overnight. However, modern human-operated ransomware campaigns do not attack systems sequentially; they infiltrate identity, disable defensive telemetry, and systematically target backup repositories long before deploying encryption payloads.

Real operational resilience requires an active defence model. By pairing round-the-clock threat detection via a managed FortiGate SOC with rigorous, scheduled restore drills that produce verifiable evidence, organisations transform security from a theoretical safety net into a predictable operational discipline.

Monday: the Identity Attack Vector and FortiGate Telemetry

Ransomware attacks rarely begin with destructive file encryption. They start silently on Monday morning with credential compromise. Threat actors leverage targeted phishing or session hijacking to gain initial access through legitimate user accounts, exploiting compromised credentials that bypass traditional single-factor controls.

When an adversary authenticates into your hybrid infrastructure, traditional perimeter firewalls treating traffic as internal vs external become blind. A managed Security Operations Centre (SOC) changes this dynamic through integrated security fabric monitoring. By correlating authentication logs from identity providers with gateway telemetry, our analysts detect initial anomalies instantly—such as a user account initiating a VPN handshake from an unfamiliar geographic region while simultaneously authenticating locally in Sandton.

According to technical guidance on Fortinet Documentation, automated fabric integration allows FortiGate devices to isolate compromised endpoints dynamically the moment suspicious activity is detected. Rather than waiting for a helpdesk ticket to be logged, the SOC automatically enforces quarantine policies at the firewall level, revoking active user sessions and blocking lateral command-and-control communication.

Wednesday: Lateral Movement and the Shadow Deletion Attempt

By mid-week, an undetected adversary attempts to escalate privileges and conduct internal reconnaissance. Their primary objective before triggering encryption is to destroy or corrupt all available restore paths. Attackers harvest administrative credentials to locate volume shadow copies, active directory snapshots, and connected network shares.

In a standard environment managed by reactive IT support, this phase goes unnoticed because the attackers use native administrative tools—a technique known as "living off the land." However, continuous 24/7 monitoring flags these subtle behavioral changes:

• Privilege Escalation Anomalies: Unexpected creation of high-privilege service accounts outside scheduled change windows.
• Mass Deletion Command Execution: Automated scripts attempting to wipe volume shadow storage or disable local security services across multiple virtual machines.
• Storage Endpoint Scanning: Unauthorized probing of internal subnet ranges targeting dedicated storage infrastructure and remote archive repositories.

By enforcing strict conditional access policies mapped to identity telemetry—as detailed in security guidelines from Microsoft Learn—our SOC containment engine isolates compromised administrative accounts before command scripts can execute destruction routines against primary or secondary data stores.

Friday: Why an Immutable Backup Is Only as Good as Your Dated Restore Drill

Suppose an enterprise successfully blocks an infection attempt, or worse, suffers partial corruption on an isolated segment. Executive management immediately asks two critical questions: "Are our backups intact?" and "How quickly can we be fully operational?"

Having an encrypted, immutable backup stored offsite is vital, but passive storage does not equal business continuity. An unverified backup is merely a hypothesis. True resilience depends on executing an active recovery drill with a verifiable timestamp—a process where system states, databases, and application dependencies are restored into an isolated environment to validate structural integrity and Recovery Time Objectives (RTO).

"A cloud backup policy without a dated restore log is simply an unverified promise. If you cannot produce a signed restore drill report from the last 90 days, your business continuity plan remains unproven."

Through our managed backup and disaster recovery framework, NovaCloud Africa conducts routine, scheduled restore drills. These drills simulate severe operational loss, proving that database transaction logs match, virtual machine images spin up without driver faults, and critical Line of Business (LOB) applications integrate seamlessly within target recovery windows.

Anonymised Case Study: 48 Hours to Clean Operations in Midrand

Consider a mid-sized financial services vendor operating between Sandton and Midrand with 140 active employees. During an after-hours maintenance window, a third-party software supply chain breach introduced a destructive malware variant onto an internal database server.

Because the organisation was integrated into our 24/7 FortiGate SOC service, the timeline unfolded with precision: