Sample case study · AWS incident response
Wrenfield Bank, a fictional $7.4 billion regional bank, confirmed a ransom note in its loan documents bucket at 00:05 on Saturday, July 4. Counsel activated Vantalect at 00:52. The containment policy went on 4 hours 18 minutes after the attacker’s first write-capable call, the bank rewrote 61.3 million imaging objects under its own keys before the attacker’s expired, and it paid nothing. Time and materials at $675 an hour, 56 hours in all, retained through the bank’s outside counsel. It shows the method, not a typical incident.
Wrenfield Bancorp, Inc. is a fictional company: every account, bank employee, and figure on this page is simulated. The AWS services and controls are real.
Wrenfield Bancorp, Inc. does not exist. We built it to show what an AWS incident response produces for a regional bank: $7.4 billion in assets, 61 branches, 1,240 employees, and twenty AWS accounts in one organization, simulated call by call. Then we ran the Response against it, stage by stage, with a fictional attacker whose first write-capable production session came after 4 days, 17 hours, 50 minutes of quiet use, and wrote the reports.
Wrenfield is fictional. Its people, customers, accounts, figures, and attacker are invented for this sample, and any resemblance to a real bank, company, person, or threat group is coincidental. The attacker’s addresses come from ranges reserved for documentation. The reports are the real deliverables, written the way we write them for a client, and they agree with each other because every figure comes from one deterministic scenario. We never cite a client’s incident, with or without the client’s name, so this is how we can show you every page. Nothing on this page is legal advice, and no legal determination is made in the reports.
An attacker had used a stolen service-account key quietly for 4 days, 17 hours, 50 minutes before the first write-capable production session, on Friday, July 3, 21:04, the observed Independence Day holiday. By 23:30 a ransom note sat in the lending documents bucket, GuardDuty had raised a finding at 22:44, and the bank’s monitoring provider had paged the on-call engineer at 23:18.
Owen Tribble confirmed the note and called Imani Castell and Mireille Danvers. Mireille called Harold Penwick, who called Diane Whitcombe at Tessaly & Brook LLP, who called Charles at 00:41. Counsel signed the emergency activation at 00:52, and Charles was on the bridge at 00:58. The attacker had also set a deadline of their own: three keys built from imported key material that would expire, taking every object written under them out of reach, on Tuesday, July 7 at 18:00.
The Response has no fixed weeks. It has stages, and each ended when someone at the bank said so. Between them, sixteen situation reports on a fixed rhythm told counsel and the executives where things stood before they had to ask. Each stage below quotes the headline of its first and last report.
Counsel’s three-party letter and the incident statement of work were signed at 00:52, and Charles joined the bridge at 00:58 with no access of his own. The bank deployed the incident role from a template its people had read first, 42 minutes after the bridge opened. The broker’s claims hotline was notified at 01:15, and the insurer’s written consent arrived at 02:10, in parallel and through the bank’s broker.
The first report said. The attacker has locked data and demanded payment. We are on the bridge with no access of our own, and containment is drafted but not applied.
The containment policy, a deny-list service control policy, was attached in the management account at 01:22, 4 hours 18 minutes after the first write-capable call. The attacker’s batch job, which had run from 21:41 on Friday and rewritten 61.3 million imaging objects (21.4% of 286 million) in 227 minutes, was canceled at 01:28. In a window of 40 seconds the attacker had also tried customer-supplied encryption keys 214 times and been refused each time.
At 02:20 Pursuit was following the first key, and at 02:50 it alerted on a second access key the attacker had created, active from the attacker address already seen in the first sessions. The policy was updated within minutes, to deny the attacker’s three principals and to close what the first version had left open (object deletes in the imaging archive, use of the attacker keys, IAM persistence, and session tokens), and a resource control policy followed at 03:20, stopping the attacker’s outside account from using the bank’s keys and roles. The deleted volume snapshots were restored the same morning.
The first report said. Containment is on and the deploy-role path is cut, but denied calls show the attacker holds other credentials. The loan snapshot is still shared with the outside account.
The organization trail and the additional sources listed in the custody register were preserved in a locked evidence account, every item hashed and entered in the custody log; the estate report names the sources that were missing and the limits that leaves. The bank had taken loan origination offline at 01:50 to freeze its state, the FBI field office was told at 06:00, and at 10:00 the bank’s determination meeting decided a notification incident had occurred. The bank notified the FDIC at 14:30 and the Federal Reserve at 14:45.
The archive was 412 TB in 286 million objects, with versioning on and no Object Lock. That is why the versions written under the bank’s own keys survived the attacker’s rewrite.
The last report of the stage said. The FBI has the complaint. No host access found; the archive reads cannot be known.
Where data was at risk the bank copied it into an isolated recovery vault in its own organizational unit, behind a deny-all policy with keys the bank held. The volume snapshot copies went under a compliance-mode lock and one recovery point of the live database under a Vault Lock; the database snapshot copies rest on the policy and the bank’s keys. The archive was too large to copy before the deadline, so the bank rewrote the attacker’s objects in place: its rewrite of the 61.3 million objects started at 09:00 on Sunday and finished at 12:40 on Tuesday. The state regulator was notified at 11:15 on Sunday.
This stage was about time, not damage: the rewrite had to beat the keys’ expiry, and the only way to know it would was to measure its rate while it ran.
The last report of the stage said. The vault copies are complete, the live-database recovery point is locked, and the database copies rest on policy. Tuesday is the attacker’s deadline.
The bank’s own check showed no current objects under any attacker key at 14:00, and the imported key material expired at 18:00 on Tuesday with nothing the bank needed under it. After preservation, the attacker’s persistence came out: one user, one access key, and two roles, and the trust on the deploy role was narrowed.
Loan origination came back online at 16:00 on Wednesday, after integrity checks, 110 hours 10 minutes after the bank took it offline, with 1,912 applications queued.
The last report of the stage said. The attacker’s identities are gone, the deploy role is narrowed, and loan origination is back online. The attacker’s keys stay in PendingImport; the calls to disable them were rejected.
Mireille Danvers declared containment in writing at 09:00, and the Response ended with the executive brief and the interim notification-clock worksheets going to counsel. The replication of the imaging archive into the vault’s Object Lock bucket began after the keys expired and was still running when the Response ended; it finished at Sunday, July 12, 21:40, after the Response ended and before the Recovery began on July 13. A short list of items stayed open, on purpose, for the Recovery to take up.
The last report said. Containment is declared in writing. This is the last report of the Response.
The Response has no gate and no outcome fee. It ends when the bank’s incident lead declares containment in writing, and what it can show is the intervals, the counts, and the hours. Each figure below is in the reports with the event that backs it.
From Friday, July 3, 21:04 to Saturday, July 4, 01:22: the policy was drafted on the bridge, approved, and attached by the bank in the management account.
At expiry, Tuesday, July 7, 18:00. The bank rewrote them under its own keys before the keys expired. A copy into the vault’s Object Lock bucket was still running when the Response ended.
Restored from the Recycle Bin the morning after the deletion. The nine manual database snapshots were restored from backup in stage three.
Time and materials, with no fee riding on a result: 56 hours at $675 came to $37,800, against a $16,200 deposit invoiced at activation and a first weekly invoice of $21,600, net of it. The bank ended it by declaring containment in writing on Thursday, July 9, 09:00. A Retainer holder would have paid $450 an hour: the same hours would have cost $25,200, $12,600 less.
What the Response does not answer. It stops the damage and keeps the evidence. It does not say how the attacker got in, what else they touched, or whether the database snapshot they shared with their outside account, which held 412,317 loan applicants’ records, was copied out. Those are the Investigation’s questions, and the Recovery closes what the answers show.
Want this response on your own organization? The Response is not yet offered.
Not yet offered.A responder proposes; the bank approves and executes. The decisions below were the bank’s and counsel’s alone, and the reports record each with its owner and its time.
Each is recorded with who made it and when. None was Vantalect’s.
The note demanded $14,500,000. The bank paid nothing. Vantalect has no role in contacting, negotiating with, or paying an attacker, and the indicators went to counsel for sanctions screening.
Recorded. In the situation reports and the executive brief.
The determination meeting, with the chief risk officer and counsel, decided that a notification incident had occurred. The clocks on the bank’s notices ran from that decision. Whether any regime applies, and when its clock started, is the bank’s and counsel’s to decide; the worksheets only compute.
Notified. The FDIC at 14:30, the Federal Reserve at 14:45, and the state regulator at 11:15 on Sunday.
The bank took the platform offline at 01:50 to freeze its state, and brought it back only after its own integrity checks, with 1,912 applications queued.
Back online. Wednesday, July 8, 16:00.
The bank rewrote the objects under its own keys in paced slices, each started only after the previous slice’s completion report showed no failed task, so a bad slice could be stopped. The rate had to be measured while it ran to know it would finish before the expiry, and the bank checked the result in its live inventory table, not in a scheduled inventory report.
Finished. Tuesday, July 7, 12:40, before the keys expired at 18:00.
What Vantalect deliberately did not do is in the containment report too: nine things it could have done and did not, each with its reason.
Pursuit is the tracker Vantalect ran the trail through. It stores CloudTrail records, follows a seed credential through every session and role it reaches, and runs a catalog of alert rules on the patterns that matter in a control-plane attack.
In this sample it ran in replay. The scenario was turned into CloudTrail records and fed through Pursuit 0.1.0, which stored 124,498 of them, followed 48 credentials and 61,858 events, and raised alerts in 59 groups. 43 of 43 comparisons with the scenario’s own expectation agree. Delivery delay in the replay is simulated.
It is described here from the sample’s own output, not demonstrated: a replay shows what the tracker produces on this scenario and is not a claim about detection in a live organization.
Denied calls in the second hour had already shown that the attacker held more than one credential. At 02:50 the tracker alerted on the second access key, which the attacker had created and was using from the same address as the earlier sessions. The containment policy was updated minutes later to cover it, and the next hour’s report recorded persistence as mapped and denied.
The attacker’s outside account may have tried the lending key again after the resource control policy went on at 03:20 on Saturday, July 4. A refused request is logged only in the caller’s account, so the bank’s trail cannot show a try either way and Pursuit could not alert on one. What the trail does show is the policy and that no outside use of the key was allowed after it.
The timeline, the session tree, and the attacker counts in the reports are the tracker’s output, so the sitreps, the containment report, and the Investigation’s narrative cannot disagree about them.
Six PDFs and 156 pages. Start with the readout; the reading guide shows how the rest fit together. Each report names its distribution on its cover. The situation reports and the containment report are operational, for the bank’s incident and platform teams; the brief, the clock worksheets, and the custody log are counsel only. The sample holds the reading guide and the Response’s five reports; the Interim Factual Statement that the Response offer describes is not part of it. Each one is tagged for screen readers, and each says on its cover that Wrenfield is fictional.
Written for the CEO and the board, and the one to read if you read nothing else: what happened, what is safe now, what is still unknown, and which decisions are theirs.
wrenfield-ir-3-brief.pdf
One page the CEO and board can read once counsel forwards it: what happened, what is protected, what is still unknown, and what decisions are theirs.
View Executive Brief at Containment in the PDF viewerDownload PDF of Executive Brief at Containment
Every action taken, who approved it, what was read before the change, how it was checked, and how to undo it, with the guardrail policies as code. Operational: for the bank’s incident and platform teams. Forward Operational reports within the approved team; counsel controls release of reports marked Counsel only.
wrenfield-ir-2-containment.pdf
Every action taken, who approved it, what it changed, what was preserved first, and how to undo it.
View Containment and Eradication Actions in the PDF viewerDownload PDF of Containment and Eradication Actions
The reading guide first, which covers all three Wrenfield engagements, then what the Response delivered, report by report.
wrenfield-0-guide.pdf
Who Wrenfield is, what happened over the Fourth of July weekend, what each of the 22 reports delivers, who may read it, and what is real and what is simulated.
View Sample Engagement Reports in the PDF viewerDownload PDF of Sample Engagement Reports
wrenfield-ir-1-sitreps.pdf
What was known, what was being done, and what came next, report by report on the fixed rhythm, for the bank’s incident team; legal items go to counsel in the clock worksheet.
View Operational Situation Reports in the PDF viewerDownload PDF of Operational Situation Reports
wrenfield-ir-4-clocks.pdf
The deadlines that may run from the client’s own determinations, computed from the times the client entered, with the facts each needs.
View Notification-Clock Worksheets (Interim) in the PDF viewerDownload PDF of Notification-Clock Worksheets (Interim)
wrenfield-ir-5-custody.pdf
Every evidence item from collection to storage, hashed, so counsel can authenticate it.
View Chain-of-Custody Log (at Containment) in the PDF viewerDownload PDF of Chain-of-Custody Log (at Containment)
The Response starts when counsel calls. A Retainer makes that call faster, cheaper, and rehearsed, and the Investigation answers what the Response could not.
A responder on the bridge who stops the damage first and preserves the evidence while doing it, hourly, from the first call until you declare containment in writing.
Read the engagement
A fictional regional bank, a week after the ransom note: how the attacker got in, what they touched, whether they are out, and the six root causes (3 of 3 critical closed as code, 1 accepted in writing), with half of the $50,000 Recovery fee riding on a closure sweep.
Read the case study
A fictional regional bank that bought the Retainer once its Recovery closed: the access role drilled in 9 minutes, the logs checked against the attacks that matter, a readiness readout, and a tabletop on a different attack, with 40 of 40 prepaid hours untouched.
Read the case studyThis is a fictional sample of a service Vantalect does not yet offer. No incident phone number or mailbox is published, and nothing on this page is an offer.
Not yet offered.
AWS, Amazon Web Services, and the AWS service names are trademarks of Amazon.com, Inc. or its affiliates. MITRE ATT&CK is a registered trademark of The MITRE Corporation. Vantalect is not affiliated with or endorsed by any of them. Wrenfield Bancorp, Inc., its personnel, its customers, and the attacker are fictional. Vantalect and Charles Sieg are the real provider and author, and the named vendors and products are real and do not endorse this sample.
