LoughTec Security Operations Centre Stops Cyber Attack on Agricultural Organisation

The LoughTec Security Operations Centre (SOC) received an email from the customer about a Windows Defender alert on the email server. The SOC found webshell and evidence of compromise on the machine in question. The customer was called and they asked not to isolate the machine. After identifying the exploit, the SOC recommended actions to finish cleaning up the server. The time between initial detection and response from the SOC was 0 minutes. The time between initial response and full resolution was less than one minute. The threat was stopped and prevented from moving laterally into other company systems.