P2022-ND-040

? Early in July 2021, the Organization discovered evidence of unauthorized access to employee computers.
? The Organization concluded that a criminal deliberately targeted its network in an attempted ransomware attack.
? The attacker did not succeed in encrypting the Organization?s systems, however, the Organization believes that the attacker was able to access and copy data from its internal networks.
? The attacker used a keylogger to acquire employee login credentials and certificates.
? In turn, credentials and certificates allowed the attacker to access the Organization?s VPN Gateway.
? The Organization reported, ?We do not know exactly what information the attacker was able to copy from our networks.?