Case study: Microsoft Defender EDR – how a ransomware attack was detected and stopped at a client from the accounting, tax and legal advisory sector.
Choosing the right cybersecurity system for a company requires a thorough understanding of its specific needs. Each company requires a different type and scope of cybersecurity protection. To select the right security package for each client, we thoroughly examine their needs, the nature of their business, and the types of data they hold. Only then do we propose solutions that will effectively protect their business and be cost-effective.
Cyberattacks on small and medium-sized businesses were once rare. However, the reality has changed. Hackers are attacking companies of all sizes and in virtually every industry. In an instant, a business can find itself unable to function, losing access to its data and entire IT infrastructure, unless it pays a hefty ransom. Furthermore, it may be forced to pay a fine for inadequate data security.
One of the most common cyber threats is ransomware. The following article explains what ransomware attacks are and how to prevent them, using a case study from one of our clients. Fortunately, this client acted proactively and secured itself before hackers attacked their IT systems.
Ransomware – what is it?
Data loss and leakage, encryption, ransom demands, and file infections are just some of the consequences that can be caused by a hacker attack. In most cases, this is done through malware. Ransomware is a type of malware that encrypts files on an infected device and demands a ransom in exchange for decryption. Attackers can, of course, blackmail a company or publicly share sensitive data. In the second half of 2024, Poland saw a 37% increase in attacks compared to the first half of the year. Microsoft Defender EDR is an advanced tool that detects, analyzes, and responds to current threats. One of our clients avoided the serious consequences of data leakage or encryption by implementing the system.
Stopping a ransomware attack
Our monitoring system, which protects the client's IT infrastructure 24/7 in real time, received a notification about a masked service or task. Later, an employee of our client reported noticing "odd system behavior"—windows opening automatically.
The Microsoft Defender for Business (EDR) used at this company triggered behavioral analysis mechanisms, detecting suspicious activity. An unknown executable file was saved in the AppData folder. The installation process for a plug-in for the popular Opera browser then began. The installer connected to an external IP address on a list of known Command & Control (C2) servers. The Defender system detected an attempt to transfer data from the employee's computer to an external server. Thanks to the automatic response, Microsoft Defender EDR immediately took appropriate action:
- Blocked the malicious process, preventing the virus from running further.
- Isolated the device from the network, preventing the spread of the infection.
- Deleted the malicious file and restored the registry changes.
- Generated a detailed report for the IT team, including an analysis of the incident and the source of the infection.
Finally, this incident was assigned to our administrator for analysis and implementation of appropriate preventive measures.
Cybersecurity with Online Support – effective protection for your company
By using Microsoft Defender for Endpoint (EDR), our client avoided a serious security incident. The system automatically detected, stopped, and neutralized the malware before it could cause any damage.
Is your company adequately protected against cyber threats?
If you are not sure which solution is best, please contact us.
For many years, we have been helping organizations effectively secure their data, systems, and resources against digital threats. Our priority is real security—tailored to the needs and specifics of your company, without unnecessary costs or redundant functionality.
Request a free cybersecurity consultation.
Write to us – we will be happy to advise you on the best, proven technological solutions.
- source: https://itnews24.pl/ransomware-szaleje-w-polsce-az-o-37-wiecej-atakow/
our
support.
What IT solutions do we use at Support Online?
When is it worth using an IT company?
Why is it worth hiring an IT company rather than a freelance IT specialist?
What are the advantages of working with IT Support Online?
An IT company, or IT firm, deals with information technology in a broad sense. This includes, among other things:
- Software design and development: An IT company can create custom applications for other companies or software products for the mass market. Depending on their specialization, these can include mobile applications, desktop applications, web applications, or embedded systems.
- Consulting services: An IT company often provides experts to advise on implementing new technologies, optimizing business processes, or selecting appropriate technological solutions.
- Cloud solutions: Many IT companies specialize in implementing and managing cloud solutions, such as data storage, application hosting, and data analysis platforms.
- IT security: Protection against cyberattacks, security audits, implementing security policies, and network monitoring are just some of the IT companies' responsibilities in this area.
- IT infrastructure management: In this area, a company may manage servers, databases, networks, and endpoints.
- Technical Support and Service: An IT company may provide support for its own products or general IT support for other companies, managing their technology on a daily basis.
- Training: Many IT providers also offer training in software use and secure technology use.
- Hardware Solutions: Some IT companies may also provide and configure computer, server, or network hardware.
Depending on their specialization and size, an IT company may offer one, several, or all of the above solutions. When choosing a provider, it's important to thoroughly understand their services and tailor them to your individual needs.
At Support Online, we have been supporting companies for years with
- comprehensive user support (both on-site and remotely),
- we service computers, phones, tablets, and related network issues,
- we specialize in server administration: Windows, Linux/Unix,
- we support virtualizers such as KVM, Hyper-V, VMWare, and Proxmox,
- we support cloud services, particularly solutions such as Azure, Microsoft 365, and AWS,
- we monitor servers and devices on the internet,
- we consult on development, DRP, and support the stability of your business in the IT layer.
If you're looking for a good IT company, Support Online is the right place to grow your business.
It's worth using an IT company like Support Online when:
- You plan to implement new technologies or software in your company.
- You need specialized technology consulting.
- You want to optimize existing IT processes.
- You struggle with digital security issues.
- You need support in managing your IT infrastructure.
- You lack internal resources or expertise to implement certain technology projects.
Using external IT experts can bring benefits in terms of saving time and resources, and ensuring high-quality solutions.
Hiring an IT company like Support Online offers several key benefits over an IT freelancer:
- Support from the entire team: An IT company has a full team of specialists, from DevOps specialists and Cyber Security Specialists to IT Helpdesk Specialists, who possess diverse skills and experience, enabling faster problem resolution and the implementation of more complex projects.
- Reliability and stability: IT companies have an established reputation and track record, which can translate into greater reliability and stability of services.
- Maintenance and support: An IT company can offer service contracts, warranties, and after-sales support, which may be more difficult to obtain from an individual freelancer.
- Resources: Companies have access to more resources, tools, and technologies that can accelerate and improve project execution.
- Long-term availability: The risk of a freelancer disappearing or changing careers is greater than the risk of a well-established company going out of business.
However, it's worth noting that the choice between a company and a freelancer depends on your specific needs and situation. If you value peace of mind and a quick response to unexpected problems, it is worth choosing an IT company such as Support Online.
Partnering with IT Support Online offers the following advantages:
- Professional IT outsourcing: The company guarantees high-quality IT outsourcing services for businesses of all sizes.
- Comprehensive IT support: IT Support Online provides comprehensive IT support that meets the diverse needs of businesses.
- Saves time and money: With our support, clients can focus on their core business activities while reducing the costs associated with information technology management.
- Serving a diverse range of businesses: The company specializes in serving both small and medium-sized enterprises and large corporations, demonstrating its flexibility and ability to adapt to diverse client needs.
- Leadership in IT outsourcing: The company is recognized as a leader in IT outsourcing, particularly in the Poznań and Warsaw regions.
By partnering with our company, IT Support Online, businesses can count on a high standard of service and professionalism at every stage of the relationship.
