printer friendly version

NEC XON detects and stops ransomware attack

Ransomware attacks rarely begin with chaos. More often, they start quietly, with probing, mapping, and patient reconnaissance inside a target’s network. That was the situation facing a global recruitment firm when cybercriminals attempted to navigate its systems.

What followed became a real-world demonstration of how modern AI-driven cybersecurity, combined with skilled human intervention, can stop an attack before it escalates into a business crisis. At the centre of the response was NEC XON and its Managed XDR service powered by Palo Alto Networks Cortex XDR.

A high-value target for cybercriminals

“International recruitment firms are particularly attractive targets for ransomware operators,” says Armand Kruger, NEC XON head of Cyber Security. “Their systems contain highly sensitive candidate data, employment records, client agreements, and workforce intelligence spanning multiple countries and jurisdictions. For attackers, disrupting those operations can create enormous pressure to pay a ransom quickly.”

In this case, the attacker had already established an initial foothold through a public-facing segment of the company’s network. “From there began what we call ‘enumeration activity’: systematically probing internal systems, identifying routes deeper into the environment, and searching for opportunities to move laterally across the network,” Kruger explains. “Had the activity gone undetected, the attacker could have escalated privileges, stolen credentials, and ultimately deployed ransomware capable of crippling the organisation’s operations.”

Instead, the intrusion was identified in real time.

AI-driven detection in real time

Continuously monitoring the customer’s environment, Cortex XDR detected unusual activity originating from the organisation’s DMZ, the public-facing boundary separating external traffic from critical internal business systems. The behaviour matched known patterns associated with attackers mapping environments ahead of a ransomware deployment. Without waiting for manual intervention, Cortex XDR automatically blocked the remote IP address responsible for the activity, effectively severing the attacker’s access before they could advance further into sensitive systems.

That rapid automated action bought time for NEC XON’s security operations team to mobilise. Security specialists quickly moved to contain the broader threat, shutting down all command-and-control communications to prevent the attacker from issuing instructions or attempting data exfiltration. Investigators identified compromised user credentials believed to have been used as the initial access point and disabled them immediately. The team then conducted a full forensic investigation to trace the source of the intrusion and provide the client with a clear understanding of how the attack unfolded - and how it had been stopped.

Confidence beyond the crisis

For the recruitment firm, the result was more than simply avoiding operational disruption. The incident reinforced the value of having around-the-clock protection backed by both intelligent automation and experienced cybersecurity professionals. In an environment where attacks are becoming faster, more sophisticated, and increasingly automated, early detection and rapid response can mean the difference between a contained incident and a major business disaster.

The case also highlights a growing reality for organisations across every sector: cyber resilience is no longer just about preventing attacks, but about detecting and neutralising threats before they can cause lasting harm.

Share this article:

Further reading: