Undercode Successfully Recovers 8 Years of Data After Unknown Cloud Ransomware Attack Targeting Saudi Dates Company
Executive Summary
Undercode Security has successfully completed a complex digital recovery and forensic investigation after a Saudi-based dates company suffered a catastrophic data-loss incident affecting nearly 8 years of critical business records.
The incident involved a previously unidentified ransomware strain combined with cloud-based encryption behavior, unauthorized remote access, and post-compromise activity designed to maintain persistence and hide attacker operations.
Unlike traditional ransomware cases where attackers only encrypt files, this incident demonstrated a multi-stage intrusion:
- External credential attacks against exposed services.
- Successful NTLM authentication.
- IIS server compromise.
- Web shell deployment.
- Privileged execution through application services.
- Security log manipulation.
- Data encryption and operational disruption.
Through forensic reconstruction and recovery procedures, Undercode restored access to critical business data without relying on attacker decryption keys.
Attack Timeline Reconstruction
Phase 1 — External Authentication Campaign
The investigation identified a large number of failed authentication attempts against Windows accounts. The attackers used external network authentication attempts targeting:
- Administrator accounts
- Service accounts
- Existing business usernames
Observed Windows Security Events:
| Event ID | Meaning |
|---|---|
| 4625 | Failed authentication attempts |
| 4624 | Successful authentication |
| 4740 | Account lockout |
| 1102 | Security log cleared |
The pattern indicates automated credential attacks rather than manual login attempts.
Confirmed Successful Intrusion
Successful Authentication Source
The investigation identified:
as the IP address associated with the successful authentication event.
Observed:
- Event ID: 4624
- Logon Type: 3 (Network)
- Authentication: NTLM
- Account Targeted: Administrator / Local Accounts
The IP address should be considered an attack infrastructure indicator, not definitive proof of attacker nationality. Threat actors frequently operate through VPS infrastructure, proxy networks, compromised servers, VPN services, and cloud providers.
Attack Infrastructure Indicators
| IP Address | Activity |
|---|---|
| 185.59.xx.99 | Successful authentication |
| 157.66.xxx.139 | Failed password attempts |
| 223.84.xxx.194 | Invalid usernames |
| 43.166.xxx.25 | Administrator targeting |
| 129.226.xxx.94 | Administrator targeting |
| 45.194.xx.237 | Failed authentication |
Technical Investigation
How The Attack Happened (High-Level)
↓
NTLM Authentication Abuse
↓
Valid Account Access
↓
IIS Application Compromise
↓
Web Shell Persistence
↓
Privilege Expansion
↓
Data Encryption
↓
Recovery Operation
IIS Persistence Discovery
During forensic analysis, Undercode discovered a malicious web shell hidden inside a legitimate application directory:
File hash:
SHA256: f274ca4c8b72cef7c92b30c5b033a275304bf556f14a5640a059b2d40e0576e2
The attacker abused IIS configuration by modifying application execution settings. Observed affected components: smacc and smaccweb.
The attacker configured IIS application execution under administrative privileges, allowing malicious code execution through the web environment.
Living-Off-The-Land Techniques
The investigation found abuse of legitimate software components. Example: OpenSSL 3.0.9. The tool itself is legitimate; however, attackers commonly abuse trusted software to generate certificates, encrypt communication, hide malicious traffic, and blend with normal administration activity. This technique is known as Living Off The Land (LOTL).
Log Manipulation & Anti-Forensics
Undercode identified evidence of security log clearing: Event ID: 1102. The Windows Security Audit Log was cleared using an administrative account.
Purpose:
- Remove authentication evidence
- Hide attacker activity
- Delay investigation
However, remaining artifacts allowed reconstruction of the attack timeline.
Data Recovery Operation
The affected environment contained approximately 8 years of company data — business records, operational databases, and critical documents.
Recovery involved:
- Disk-level forensic analysis
- File system reconstruction
- Malware artifact removal
- Timeline correlation
- Integrity verification
Fact Checker ✅
Many ransomware incidents involve only encryption. However, modern groups increasingly combine data theft, credential abuse, cloud access, and extortion.
Claim: “MFA would always stop this attack.”
Verdict: PARTIALLY FALSE
MFA significantly reduces risk, but attackers increasingly target session tokens, OAuth permissions, existing authenticated sessions, and weak recovery processes.
Undercode Threat Prediction 🔮
Based on this incident, Undercode predicts:
- More Hybrid Ransomware Attacks — Future ransomware campaigns will increasingly combine credential attacks, cloud abuse, API compromise, and identity theft.
- IIS Servers Will Remain High-Value Targets — Organizations running public websites, ERP systems, and custom business applications should expect continued targeting.
- Recovery Will Become A Competitive Advantage — Organizations with offline backups, immutable storage, and tested recovery procedures will recover faster than organizations focused only on prevention.
Security Recommendations
- Disable unnecessary internet exposure
- Restrict NTLM authentication
- Enforce MFA everywhere
- Monitor privileged accounts
- Protect backup systems from ransomware access
- Perform regular incident response testing
- Deploy endpoint detection and response solutions
Final Statement
This incident demonstrates that ransomware defense is no longer only about preventing encryption. Modern attacks combine: Identity compromise + persistence + stealth + encryption.
Undercode’s investigation successfully transformed a major data-loss incident into a complete forensic understanding of attacker behavior and a successful recovery operation.