Inside a ransomware negotiation: 72 hours with a LockBit affiliate

The call came in at 04:12 on a Tuesday. A regional logistics firm, roughly 900 employees, had woken up to every Windows server displaying the same ransom note. Their backup appliance had been wiped two hours earlier. They had our retainer, so within 14 minutes three of us were on a bridge with their IT lead and general counsel.

Hour 0–6: contain before you talk

The first rule of ransomware response is simple: do not open the negotiation portal until you know how the attacker got in and whether they still have access. We isolated the domain controllers, revoked every Kerberos ticket by resetting the krbtgt account twice, and pushed an EDR containment policy to all 1,140 endpoints.

$ sentinel ir contain --scope all --policy isolate-except-soc
[ok] 1,138 / 1,140 endpoints isolated
[warn] 2 endpoints offline: WH-SCAN-07, WH-SCAN-11

The two offline machines were warehouse barcode scanners running Windows 10 IoT. One of them turned out to be the initial foothold, compromised through an exposed VNC service with a default password.

Hour 6–30: what did they actually take?

The affiliate claimed 1.8 TB. Firewall flow logs and the cloud storage audit trail told a different story: 212 GB left the network, mostly shipping manifests and scanned customs forms. Painful, but not the HR and finance archive they were threatening to leak.

Attackers exaggerate. Your logs do not. Every hour spent on forensics before negotiating is leverage.

Restoring without paying

Their backup appliance was gone, but the company had an immutable S3 bucket with weekly snapshots we had recommended a year earlier. Restoration of the core TMS took 31 hours. Warehouse operations resumed on paper in the meantime.

Hour 30–72: the negotiation

With operations restored, the only remaining lever was the leak threat. Working with counsel and the national CERT, the client decided not to pay. We kept the channel open to buy time for customer notifications, then closed it. The leak site posted 40 GB of manifests, which the company had already disclosed to affected customers.

Lessons we keep relearning

• Inventory the boring devices: scanners, printers, HVAC controllers.
• Immutable, offline backups turn a crisis into an inconvenience.
• Have counsel and a responder on retainer before you need them.

If you want to know whether your own environment has an exposed VNC or RDP service right now, our free threat check will tell you in about a minute.