Troubleshoot — Backups deleted during a ransomware attack

حل مشكلة — الـ Backups اتمسحت وقت هجوم Ransomware

Incident SEC-118 (Priority 1): "An attacker used a compromised admin account: they stopped protection and deleted the backup data of the file server vm-ts-files , then encrypted the server. Vault: rsv-ts-bk2 in rg-ts-bk2 ." Investigate, get the backup data back, bring up a clean copy of the server, and harden the vault so this cannot happen the same way again.

The 4 tasks you will do

• Task 1 — Investigateالمهمة 1 — التحقيق
• Task 2 — Get the backup data backالمهمة 2 — رجّع بيانات الـ Backup
• Task 3 — Bring up a clean serverالمهمة 3 — طلّع سيرفر نضيف
• Task 4 — Harden the vaultالمهمة 4 — أمّن الـ Vault