Not a MalwareAnalysis.app client engagement
This case is a published illustration from the Australian Cyber Security Centre’s Small Business Cyber Security Guide (June 2023). It is not work performed by Cybersecurity Engineering Pty Ltd.
Staff at an auto parts store arrived to find the server would not boot. The IT provider found a window demanding bitcoin to unlock the files. A backup drive was plugged into the same machine and had been encrypted with everything else. They connected more backup disks. Those files were encrypted within seconds. The firm had not removed the ransomware before trying to recover, and they lost every copy they had. The remaining option was a factory reset and a new system. Years of data went with the old one.
That is why “we have a backup” is not the same statement as “we can restore.” If the copy is mounted and writable by the operating system that just got ransomware, it is another disk for the encryptor. The design that survives is a copy the live machine cannot reach: a disk you unplug after the job, or a cloud store the ordinary user cannot delete or alter. Test a restore on a quiet day. An untested backup is a hope.
What to do this week
- Confirm there is a backup that is offline or immutable.
- Restore one file from it so the copy is not a rumour.
- Print the incident phone list and put it where the server cannot take it with it.
Sources
Accountability
Published by Cybersecurity Engineering Pty Ltd, trading as MalwareAnalysis.app. This is general guidance, not advice about your incident. A named expert profile will be attached once approved for publication. Review this page again after 5 March 2027, or sooner if official ASD or OAIC guidance changes.
Related: Ransomware response · Get incident help.
Use the evidence in context
This article reflects understanding at its stated publication and review dates. It is general information, not advice about your specific incident, system or legal position.