Unpatched, Unsegmented, Unprepared: A Ransomware Recovery Insight

When a manufacturing organization with two physical sites was compromised through an unpatched FortiGate 60E firewall running a vulnerable FortiOS 7.2.2 build affected by CVE-2022-42475, alongside a set of end-of-life Windows Server 2012 hosts, the incident response team uncovered far more than encrypted files.  The environment had a fully flat network with switch loopbacks, no DHCP failover, and backups that had never been audited, meaning entire servers were missing from the backup set without anyone knowing. This session walks through the full incident lifecycle: initial access through the unpatched firewall and legacy servers, confirmed data exfiltration alongside encryption, forensic preservation through full host imaging and triage collection before any remediation began, and the decision to pursue a decryptor rather than risk an estimated 50 percent data loss across the environment, including Active Directory. Attendees will see the exact hardening checklist used across both sites, covering network containment, Active Directory and Kerberos resets, GPO and credential audits, and EDR plus anti-ransomware deployment, along with the specific gaps in the client's prior security posture that allowed the incident to happen in the first place. This talk is built for both technical responders who want the operational detail and less technical attendees who need to understand how a single unpatched device cascades into a two-site recovery effort.