A German real estate company had its production environment compromised after an Akira Ransomware attack, which occurred through the exploitation of a vulnerability.
The attack primarily targeted the virtual machines stored in VMDK files, leaving approximately 2 TB of data inaccessible and disrupting essential company operations.
The affected environment consisted of a virtualized infrastructure stored on multi-disk storage systems. The encryption compromised the VMDKs of the virtual machines used in the production environment.
In addition to the volume of data involved, the client needed to regain access to the information within a short timeframe, as the unavailability directly impacted business continuity.
Although a backup existed, that medium was not included in the analysis and recovery process.
Digital Recovery initiated a specialized analysis of the storage structure to identify the preserved data and define the best recovery strategy.
The work focused on reconstructing the volumes and analyzing the compromised VMDK files, using proprietary technologies developed for the recovery of virtualized environments.
Due to the criticality of the case, the project was conducted on a 24×7 basis, with high-performance infrastructure and continuous processing.
To expedite the return of information to the client, the recovered data was made available progressively via an SFTP server.
Result
In approximately 10 calendar days, from the intake of the environment for analysis to the completion of the recovery, it was possible to restore the client’s access to the data that had been unavailable after the attack.
The recovery made it possible to reduce the impact of the downtime and create the conditions necessary for the resumption of operations.
The client expressed satisfaction with the result, mainly for regaining access to essential information that had become completely unavailable.
This case shows that even when a ransomware attack compromises virtual machines and the production environment, a specialized technical analysis can identify alternatives for data recovery without relying exclusively on traditional restoration mechanisms.
