Tales From the Incident Response Cliff Face – Case Study 3

**Executive summary:** This report describes a real-time BlackByte ransomware intrusion against a large European manufacturer where attackers abused an unmanaged VPN account (local cisco user), performed password spraying and Kerberoasting to obtain domain admin privileges, used off-the-shelf tooling (Impacket, CrackMapExec, LSASS dumping modules, BlackByteSQLManager) for lateral movement and data discovery, and established persistence (AnyDesk, local admin accounts); the incident response team chose a surgical containment approach while completing EDR deployment, disabling the obsolete VPN, removing malicious AnyDesk instances, resetting accounts, and blocking exfiltration channels to prevent encryption and data theft.