Core Security’s team swiftly initiated an exhaustive forensic analysis, focusing on identifying the ransomware variant, entry points, and potential additional threats. Our investigation revealed a deeper, more insidious issue: the attackers had also installed covert crypto-mining software on the company’s servers. This software had been silently running for months, siphoning off valuable computational resources to mine cryptocurrency. The forensic analysis traced the origins of both the ransomware and the crypto-mining activities to a sophisticated cybercriminal group operating out of Eastern Europe. In collaboration with international law enforcement agencies, Core Security provided critical forensic evidence that helped authorities track the perpetrators. The investigation led to a multinational crackdown on the ransomware cybercriminal group, resulting in the apprehension of several key members responsible for the attack on our client and other companies.