Not just DNS, it was their entire Active Directory Global Catalog. If it weren't for that server, they would have needed to re-create their entire user database, all of their endpoint & server management policies, and it would have been almost impossible to safely restore their Exchange email database. They got very very lucky.
Sounds very interesting, but the story seems to be behind a paywall. I found some other articles[0][1] related to the incident, however none of them seem to mention the flying of a hard drive across continents.
0: https://www.zdnet.com/article/ransomware-the-key-lesson-maer...
1: https://portswigger.net/daily-swig/when-the-screens-went-bla...
Re:The absolute worst scenario happened
by Eremotherium on Monday March 22, 2021 @09:41AM
(#26540629)
Or if you want the story as a podcast I can wholeheartedly recommend this episode (and the podcast in its entirety) of Darknet Diaries:
A similar podcast, Malicious Life, just released a two-part episode about it too:
Seconded! Great story and amazing podcast.
There’s a capture in the Wayback Machine: https://web.archive.org/web/20180822190926/https://www.wired...
Re:The absolute worst scenario happened
by erikstarck on Monday March 22, 2021 @09:34AM
(#26540548)
Sorry about the paywalled article. Here’s a summary of the same article:
https://www.chrislouie.net/blog/2018/9/10/better-to-be-lucky...
All computers except one, which due to a power failure had been offline the whole time.
This computer had the critical DNS information needed to restore the network.
Only problem: it was in Africa, in a country that required Visa which would take weeks to apply for and receive. So someone from the African office had to bring the hard drive to an airport that someone from the London office could travel to and pick up the critical hard drive, then bring it on a plane back to London.
A sweaty and nervous trip, I can imagine.
Whole story here: https://www.wired.com/story/notpetya-cyberattack-ukraine-rus...