Lender learns within days that two backdoors were planted but never used
A small consumer-finance lender. Outcome verified
The problem
A small consumer-finance lender running its own on-premises email server was swept up in a mass exploitation of a disclosed vulnerability. Its IT contact had patched and blocked access within a day, but leadership could not tell whether the attackers had gone further into the network or taken data. The server had no process logging and the company had no security staff.
Why it mattered
In the worst case, attackers with control of the mail server could have reached the company file share and customer financial records, with regulatory and reputational consequences for a lender.
What we did
Vizius applied a structured incident-response methodology to both the email server and the domain controller, examining processes, services, accounts, connections and logs, and reconstructed a day-by-day timeline of the intrusion. It then turned the findings into a prioritized recommendation list rather than a bare forensic report.
What changed
The investigation confirmed two backdoors had been installed but found no evidence the attackers moved beyond the mail server or took any manual action, giving leadership a defensible scope of compromise within days. Retiring the on-premises server for cloud-hosted email was proposed as the next project.
- Financial services
- Small company