Case Study: How We Removed Ransomware From a Melbourne, FL Business

Client details have been changed to protect privacy. The technical events described are accurate.

On a Tuesday morning in early 2026, a 6-person professional services firm in Melbourne, FL arrived at the office to find their server displaying a ransom note. Files across the network had been encrypted overnight. The ransom demand was $12,000 in Bitcoin. The business had no IT support contract, no tested backup, and no incident response plan.

They called Best Computer Tech at 8:14 AM.

The Problem

The firm used a Windows Server 2019 file server shared among 6 workstations. The server was accessible via Remote Desktop Protocol (RDP) directly from the internet — a common but dangerous configuration that exposes the server to automated brute-force attacks 24 hours a day.

Attackers had been scanning Melbourne IP ranges for open RDP ports, found this server, and spent approximately 72 hours brute-forcing the administrator password. Once in, they deployed LockBit ransomware — a sophisticated strain designed to encrypt network shares while avoiding detection by common antivirus tools.

By the time employees arrived Tuesday morning, approximately 340GB of client files, contracts, financial records, and project data had been encrypted.

Initial Response (First 2 Hours)

Our first instruction by phone: do not shut down the server. Some ransomware variants continue encrypting on restart, and certain recovery techniques require the system to be in its current state.

We dispatched an on-site technician within 40 minutes. First action on arrival: disconnect the server from the network switch (not shutdown) to stop any active encryption and prevent spread to workstations. The workstations themselves were assessed — three showed signs of active infection and were also disconnected.

We documented the ransom note, identified the ransomware strain from the file extension and ransom note format (LockBit 3.0), and checked nomoreransom.org. No free decryptor was available for this strain at the time.

Diagnosis: What Actually Happened

Forensic review of Windows Event Logs revealed the attack timeline precisely: RDP brute force attempts starting Saturday at 11 PM, successful login at 2:17 AM Sunday using the account "Administrator" with a weak password, lateral movement to mapped network drives Sunday evening, ransomware deployment beginning Monday at 11:45 PM.

Critical finding: the business had an external hard drive labeled "Backup" connected to the server. It had been encrypted along with everything else — not a functional backup because it was permanently connected to the server and visible as a network drive.

Recovery Process

With no usable backup and no free decryptor, recovery options were limited. We advised strongly against paying the ransom — payment does not guarantee decryption, funds criminal operations, and often results in follow-up attacks against confirmed-paying victims.

Shadow Copy assessment: Windows Volume Shadow Copies are automatic snapshots Windows creates during updates. The ransomware had attempted to delete them but had not been fully successful. We were able to recover approximately 60% of files from shadow copies — a partial but significant recovery.

The server was wiped and rebuilt from a clean Windows Server installation. The three infected workstations were wiped and reimaged. Total rebuild time: 2 days.

Outcome

The business recovered approximately 60% of its data from shadow copies. The remaining 40% was reconstructed from email attachments, client-side copies, and manually recreated documents over the following two weeks.

The ransom was not paid. Total recovery cost (our labor, hardware, and software): approximately $3,800. Far less than the $12,000 ransom demand — and without the guarantee risk that payment carries.

Business was partially operational within 48 hours and fully operational within 10 days.

What We Put in Place After Recovery

After recovery, we implemented protections to prevent recurrence: RDP disabled and replaced with VPN-gated remote access, administrator account renamed and given a 20-character random password, MFA required for all remote access, Windows Server moved behind a properly configured firewall, automated daily cloud backup configured (separate from the local network), and the business enrolled in our managed IT plan for ongoing monitoring.

The same attack attempted on this network today would fail at the first step — the RDP port is closed, and even if attackers found another entry point, the 24/7 monitoring would alert us within minutes.

The Lesson for Brevard County Businesses

This business had a "backup" that was not a real backup. They had RDP open to the internet — a configuration we see constantly in small businesses across Palm Bay and Melbourne. They had no monitoring, no incident response plan, and no IT partner to call until the crisis was already underway.

All three of these failures are fixable before an attack for less than the cost of one month of downtime. If you want a free assessment of your business's current exposure, call us at (321) 953-5199.