March 7, 2026

Summary

A global manufacturer operating across Europe, America, and Asia needed to recover from major malware and ransomware incidents without compromising day-to-day operations. The environment supported several hundred users across multiple international sites, so the response had to restore stability quickly while reducing the likelihood of repeat disruption.

Challenge

The business suffered major operational disruptions following significant malware and ransomware incidents. These events exposed vulnerabilities in the existing security framework and highlighted an immediate need to restore services securely and prevent recurrence. The legacy endpoint protection was no longer sufficient to defend against modern threats, and underlying infrastructure weaknesses increased the risk of repeated attacks.

Objectives

To address the security incidents and strengthen the company’s defensive posture, the following objectives were established:

1. Immediate Recovery: Execute disaster recovery procedures to contain the threats, eradicate the malware, and restore critical business operations with minimal further data loss.
2. Endpoint Security Modernisation: Replace the incumbent endpoint protection solution with a modern, comprehensive platform across all 350 corporate devices.
3. Infrastructure Hardening: Identify and upgrade vulnerable servers and optimise directory services to reduce the overall attack surface and improve manageability.

Approach and Delivery

A multi-faceted approach was taken, combining immediate tactical recovery with strategic infrastructure improvements. The project lead executed the company’s virus disaster recovery playbook to stabilise the environment, which involved isolating affected systems and restoring services from backups.

Following the initial recovery, a planned migration from the legacy McAfee solution to Bitdefender was initiated. This project covered all 350 endpoints globally and involved deploying a full suite of protection, including firewall, antimalware, and content control capabilities.

In parallel, work was undertaken to streamline Active Directory, restructuring the environment and optimising Group Policy Objects (GPOs) to enforce stronger security controls and simplify administration. Vulnerable servers identified during the incident response phase were prioritised for upgrades to bolster the core infrastructure.

Technical Implementation

• Incident Response: Existing disaster recovery procedures were used to contain the incident, safeguard critical systems, and restore affected services with controlled recovery tooling and disciplined backup processes.
• Endpoint Protection: All 350 endpoints were migrated from a legacy McAfee deployment to Bitdefender. The rollout enabled centrally managed firewall, anti-malware, and content filtering capabilities across the estate.
• Server and Directory Hardening: Vulnerable servers were upgraded to patched and supported versions. The Active Directory structure was redesigned, and Group Policy Objects were consolidated and refined. This improved both security posture and day-to-day manageability.

Outcome

The project successfully restored operations and significantly enhanced the organisation’s resilience against future cyber threats. The immediate impact of the ransomware and malware was contained, and business functions were returned to a stable state.

The deployment of a modern endpoint protection platform provided advanced, centrally managed security controls, while the Active Directory optimisation made the environment more secure and efficient to manage. The combination of tactical recovery and strategic hardening resulted in a stronger, more defensible IT infrastructure for the global business.

Risks, Controls and Governance

The primary risk during the project was further operational disruption during the recovery and migration phases. This was controlled through disciplined recovery tooling, validated backup processes, and tightly sequenced remediation activity.

A second risk was incomplete eradication of the threat leading to reinfection. That was mitigated by combining incident recovery with server remediation, directory hardening, and a full endpoint protection uplift rather than treating the event as a one-off cleanup.

Key Lessons

This incident recovery project highlighted that a reactive security posture is insufficient. Proactively modernising endpoint protection and hardening core infrastructure are critical activities for preventing major business disruption. A well-defined disaster recovery plan is essential for minimising impact when an incident does occur. Furthermore, continuous improvement of foundational IT systems, such as Active Directory, is a vital component of a robust, defence-in-depth security strategy.

Related Services

• Endpoint Security Hardening (ASR, BitLocker)
  Implement Windows endpoint security hardening using ASR rules and BitLocker through Intune to reduce attack surface without disrupting users.
• Incident Response & Forensics
  On-demand incident response and forensic triage to contain threats, preserve evidence, restore operations, and define practical improvements after incidents.
• Disaster Recovery (Azure Site Recovery)
  Design disaster recovery using Azure Site Recovery with defined RTO and RPO targets, tested failover, and operational runbooks.
• EDR Platform Migrations
  Plan and execute EDR platform migrations with controlled pilots and cutover so endpoint protection remains continuous throughout transition.