When Threat Actors Behave Like Managed Service Providers

This account describes a ransomware attack on a company where the attacker deployed encryption, exfiltrated hundreds of gigabytes of data, and pressured the victim into ransom payment; the response was hampered by the customer's reckless actions (allowing attacker RDP access, refusing credential changes, open firewall rules, no backups or insurance), resulting in extended downtime, data compromise, and reputational damage.