How We Detected Ransomware in 8 Minutes

Executive Summary

Attack Type: LockBit 3.0 ransomware

Initial Access: Compromised VPN credentials (no MFA)

First AI Detection: 11 seconds after VPN login (geo-anomaly)

Ransomware Detected: 8 seconds after execution

Full Containment: 3 minutes 22 seconds from ransomware execution

Outcome: Zero files encrypted. Normal operations resumed within 2 hours.

The Attack Timeline

02:47:00 AM — Initial Access

An attacker authenticates to VPN using compromised credentials belonging to an IT administrator. The credentials were obtained through an infostealer malware infection on the admin's personal device (we later found the credentials for sale on a dark web marketplace for $15).

02:47:11 AM — AI Flags Geo-Anomaly (First Detection)

Our Brute Force Analyst agent flagged the VPN login within 11 seconds:

Login originated from Bulgaria — the admin is US-based
Login occurred at 2:47 AM local time — outside normal working hours for this account
No prior login history from Eastern Europe for this user

The AI agent classified this as a Medium-severity geo-anomaly and opened an investigation. Our SOC analyst was notified and began reviewing the VPN session.

02:48–02:53 AM — AI Detects Reconnaissance

While the SOC analyst investigated the VPN alert, the attacker began reconnaissance. Our Windows Security Analyst agent detected each command in real time:

net user /domain — Domain user enumeration (MITRE T1087)
net group "Domain Admins" /domain — Privilege discovery (MITRE T1069)
ping sweeps to file servers — Network discovery (MITRE T1018)
vssadmin list shadows — Backup enumeration (MITRE T1490 preparation)

The Windows Security agent correlated these commands with the Brute Force agent's geo-anomaly finding and escalated the incident to High severity. The SOC analyst now had full context: a foreign VPN login followed by domain reconnaissance — classic pre-attack behavior.

02:55 AM — Ransomware Staging & Execution

The attacker uploaded a ransomware binary to C:\Windows\Temp\svchost.exe (masquerading as a legitimate Windows process) and executed it. The binary was LockBit 3.0, a ransomware-as-a-service variant known for fast encryption.

How the AI Caught It

Within 8 seconds of execution, three AI agents flagged simultaneous critical findings:

Malware Analyst Agent: Suspicious Process

EDR telemetry from Microsoft Defender for Endpoint showed:

svchost.exe running from C:\Windows\Temp (legitimate svchost always runs from C:\Windows\System32)
Process had no digital signature
Process parent was cmd.exe launched via the attacker's RDP session

Our Malware Analyst agent matched the binary's SHA256 hash against threat intelligence feeds and confirmed: LockBit 3.0 ransomware.

Windows Security Analyst Agent: Ransomware Behavior

Within seconds of execution, our Windows Security Analyst agent detected:

Attempt to delete Volume Shadow Copies (vssadmin delete shadows /all) — MITRE T1490
Attempt to disable Windows Defender (Set-MpPreference -DisableRealtimeMonitoring $true) — MITRE T1562.001
Rapid file access pattern (100+ files accessed in 10 seconds) — MITRE T1486 preparation

Orchestrator: Cross-Agent Correlation

The AI orchestrator linked all findings into a single Critical incident:

Geo-anomalous VPN login (Brute Force agent, 02:47)
Domain reconnaissance commands (Windows Security agent, 02:48–02:53)
Known ransomware binary execution (Malware agent, 02:55)
Shadow copy deletion and AV tampering (Windows Security agent, 02:55)

AI + Human: Layered Detection

The AI platform didn't wait for the ransomware to execute. It flagged the foreign VPN login at 02:47, escalated during reconnaissance at 02:48–02:53, and confirmed ransomware at 02:55. By the time the Critical alert fired, our SOC analyst had been investigating this session for 8 minutes and already had full context.

That context meant the analyst could validate the ransomware alert and initiate containment in under 30 seconds — instead of the typical 5–15 minutes it takes to triage a cold alert.

The Response: 3 Minutes 22 Seconds to Containment

02:55:08 AM — Analyst Confirms & Initiates Playbook

The SOC analyst — already investigating the VPN anomaly — saw the Critical ransomware alert and immediately confirmed true positive based on:

Known ransomware hash (LockBit 3.0)
Shadow copy deletion in progress
Full attack chain context from the AI platform (VPN → recon → ransomware)

Escalated to P1, initiated ransomware containment playbook.

02:55:30 AM — Automated + Manual Containment

Analyst executed containment via Defender for Endpoint and Azure AD:

Network isolated the affected machine (prevented lateral movement)
Killed the ransomware process via EDR remote response
Disabled the compromised VPN account in Azure AD
Terminated all active sessions for that account

02:57 AM — Blocked the attacker's source IP at the firewall.

02:58 AM — Called the organization's on-call IT contact to brief on the incident. Confirmed no business impact — attack occurred during off-hours.

Containment Complete: 02:58:22 AM

Time from ransomware execution to full containment: 3 minutes 22 seconds
Time from first AI detection (VPN anomaly) to containment: 11 minutes 22 seconds
Files Encrypted: Zero
Systems Impacted: One workstation (isolated, reimaged)

Post-Containment: Scope Assessment

With the threat contained, the analyst assessed scope:

Systems accessed: Only one (the admin's workstation via RDP)
Files encrypted: Zero — ransomware was in preparation phase (deleting shadows) when we killed it
Data exfiltrated: None — firewall logs showed no large outbound transfers. The attack was too short for LockBit's typical exfiltration phase
Backups affected: No — backups are air-gapped and the ransomware never reached backup systems

Why This Worked: AI + Human Analyst

What the AI Did

Detected geo-anomalous VPN login in 11 seconds
Flagged each recon command as it executed
Correlated VPN + recon + ransomware into one incident
Matched ransomware hash against threat intel in real time
Escalated severity automatically as the attack progressed

What the Human Did

Began investigating VPN anomaly before the ransomware launched
Validated the Critical alert in under 30 seconds (had context)
Executed containment playbook with precision
Called the organization's IT contact within 3 minutes
Performed thorough scope assessment and root cause analysis

Root Cause Analysis

Post-incident investigation revealed:

How Credentials Were Compromised

IT admin used the same password for VPN and personal email
Personal email was compromised in a data breach (found on haveibeenpwned.com)
Credentials sold on a dark web marketplace for $15
VPN had no MFA requirement for admin accounts

Why Traditional Defenses Failed

Antivirus: Attacker disabled it via PowerShell before it could act
Firewall: Legitimate VPN connection appeared normal
Email security: Not applicable — this was credential theft, not phishing

Remediation & Hardening

After containment, we worked with the organization to prevent recurrence:

Immediate Actions (Week 1)

Enforced MFA on all VPN accounts (no exceptions)
Rotated all privileged credentials (domain admins, service accounts)
Reimaged affected workstation (forensic image preserved)
Enabled geo-blocking on VPN (whitelist approved countries)
Implemented impossible travel alerts in Azure AD

Long-Term Hardening (Month 1)

Deployed privileged access workstations (PAWs) for admin tasks
Implemented Just-In-Time admin access (JIT, Azure AD PIM)
Disabled RDP for all non-admin users
Deployed Defender ASR rules (Attack Surface Reduction):
- Block credential theft from LSASS
- Block process creation from PSExec/PsTools
- Block Office from creating executable content
Implemented application whitelisting on critical servers

By The Numbers

11s

First AI Detection

3:22

Ransomware Containment

Files Encrypted

AI Agents Involved

The Alternative Timeline

What if no one was watching?

LockBit 3.0 can encrypt 100,000 files in 4–5 minutes on a modern system. Without AI-powered detection and a 24/7 SOC, the attacker could have:

Encrypted the admin's workstation (5 min)
Moved laterally to 3–5 additional systems via RDP (10 min)
Reached file servers and begun mass encryption (15 min)
Potentially encrypted 50–100GB of critical data

Estimated impact without MDR:

Ransom demand: $250,000 (typical for mid-size organizations)
Downtime: 3–7 days (restore from backups)
Regulatory: Breach notification required
Total cost: $500K–$1M (ransom, downtime, remediation, legal, PR)

Actual impact with AI + human MDR:

Ransom paid: $0
Downtime: 2 hours (one workstation reimaged)
Regulatory: No breach notification required
Total cost: ~$5K (analyst time + workstation reimage)

The Bottom Line

Our AI platform detected the attacker 11 seconds after VPN login, tracked every move through reconnaissance, and caught the ransomware 8 seconds after execution. A human analyst — already investigating with full context — contained the threat in 3 minutes 22 seconds. That's the difference between a $5K incident and a $500K+ breach.

Conclusion

This incident demonstrates why AI-powered MDR exists. Traditional security tools (firewall, antivirus, VPN) all failed to stop the attack. What stopped it was:

AI-powered detection that flagged the foreign VPN login in 11 seconds
Multi-agent correlation that connected VPN anomaly → recon → ransomware into one attack chain
Threat intelligence that identified LockBit 3.0 instantly
Human expertise to validate and execute containment with precision
24/7 coverage so a 2:47 AM attack didn't wait until 8 AM to be investigated

The organization avoided a $500K+ ransomware incident because AI detected the threat in seconds and a human analyst contained it in minutes. That's the value of AI-powered MDR.

Want AI-powered ransomware protection?

Our MDR service combines proprietary AI detection with human expertise to stop ransomware before encryption begins.

Book a Free Consultation