A bakery and confectionery plant: recovery after a ransomware attack and a custom CRM

A bakery and confectionery plant in Moldova — biscuits, cakes, bread. The client came to us not preventively, but in the middle of a crisis: their production environment had been hit by a ransomware attack. Workstations and part of the Windows servers had been encrypted, operations had stopped, several departments were down.

The good news, visible only when the bad news has already happened: the company's main database — Oracle on Linux — was untouched. That wasn't luck, but a consequence of architectural separation: critical data lived on a different operating system and in a different segment, and the ransomware couldn't reach it. That spared the company the most painful outcome — data loss.

The infection vector was identified fairly quickly — a phishing email to the corporate inbox. Work then ran on two parallel tracks: restore operations, and close the specific vector through which the trouble had arrived.

Crisis response and parallel hardening, so that a repeat becomes meaningfully less likely:

• Restore the production environment — clean infected workstations, reconfigure servers, get people back to their stations.
• Re-architect the network with proper segmentation and traffic control on a modern firewall.
• Deploy XDR endpoint protection: continuous telemetry, event correlation, automatic node isolation on suspicious behaviour.
• Close the original attack vector — stand up a secured mail server with phishing, attachment and dangerous-link filtering.
• Prepare a move to the cloud — the client is currently on its own local servers; we are discussing migration onto our cloud platform along the same model we have used for other clients of similar scale.
• Within the Garm group — build a custom CRM for the client through the RedBox project: customer management, SMS notifications, operational accounting.

Crisis response

Phase one — stop the spread and bring operations back. Infected workstations were cleaned, some reinstalled from gold images. Encrypted data was recovered from existing backups as far as possible. An inventory was done: which accounts were compromised, which passwords had to be rotated, which services had to be reconfigured.

What saved the client: UNA on Oracle/Linux in a separate segment

The most valuable asset for the business — the UNA accounting system running on Oracle under Linux — was untouched. The ransomware spread through the Windows segment and had no access to the Linux server hosting UNA. That's a textbook example of why architectural and platform separation of critical systems isn't a theoretical "best practice" but a very practical way to limit the damage of an incident.

A new network and FortiGate

The network was re-architected with proper segmentation: production, office workstations, server segment, guest network and external access were split into separate VLANs with controlled traffic between them. A FortiGate was placed at the perimeter — traffic filtering, application control, control over outbound calls to suspicious nodes. With that kind of control in place earlier, the ransomware would have had significantly fewer ways to call out to its command server and to network neighbours.

XDR endpoint protection

An XDR is deployed on every workstation and server: continuous telemetry, event correlation, automatic node isolation on suspicious behaviour. Unlike a classical antivirus, XDR doesn't watch "file signatures" — it watches behaviour chains: a suspicious process, access to a network resource, attempts to encrypt files — and reacts before the damage becomes broad.

Closing the source: a new mail server with phishing protection

Since the original vector was email, a new mail server was stood up with modern protection: phishing filtering, sandboxed attachment analysis, link rewriting with click-time verification, sender impersonation protection (SPF / DKIM / DMARC). It doesn't cover everything, but it covers exactly the class of attacks that brought the ransomware in.

Local servers and negotiations to move to the cloud

For now the client remains on its own local servers. In parallel, we are discussing a move to our cloud platform along the same model we have already used for other clients: a predictable SLA, latest-generation servers with NVMe and DDR5, unified monitoring, verified backups, platform-level fault tolerance. The case is built on our own experience: we show the client that in real projects this has been done with no meaningful cost increase and a noticeable performance gain.

CRM from the RedBox project: inside the Garm group

In parallel with the infrastructure work, the client also needed a custom CRM: customer management, communication history, SMS notifications, operational accounting tuned to the production-and-retail profile. That work was taken on by RedBox — the custom-software development line within the Garm group. The result is a single coherent story: one group of companies delivers both the infrastructure and the bespoke software; the specialists communicate directly, with no handoffs between separate vendors.

Why this works: the full Garm-group spectrum

This isn't a marketing line — it's an observation from real projects: when both infrastructure and bespoke software are delivered by one group of companies, a whole category of pain disappears for the client — vendor finger-pointing, lost context on hand-offs between teams, mismatched SLAs. The Garm group covers several lines (system administration, IT security, custom software, consulting, vCIO), and in projects where several lines are needed at once, this is usually simpler, faster and cheaper for the client than working with three or four independent companies.

Outcome

• Production was restored — workstations, servers and operations are back online.
• The UNA accounting system was saved — thanks to architectural separation (Oracle on Linux in a separate segment), critical data survived the attack with no losses.
• The network was re-architected with FortiGate at the perimeter and segmentation inside — controlled traffic instead of "however it grew".
• XDR on endpoints — reacting to suspicious behaviour, not just signatures.
• The new mail server closes the original attack vector.
• The RedBox CRM is live and serves customer interactions and SMS notifications.
• The cloud migration is in progress, on a model proven on other projects.