The Tool Desk
Outbyte PC Repair FREERepair Windows errors before they cause bigger problemsFix Now →Outbyte Driver Updater FREEFix the driver behind crashes, sound loss and screen glitchesFind Drivers →iTechGuides is reader-supported. When you buy through links on our site, we may earn an affiliate commission. As an Amazon Associate I earn from qualifying purchases. Learn more
In a case published by The DFIR Report on October 8, 2020, attackers moved from execution of the Bazar backdoor loader to Ryuk ransomware across the domain in 29 hours. The sequence began with an email link, continued through reconnaissance and lateral movement, and ended after the operators prepared the backup server and deployed the ransomware. That 29-hour measure describes this incident—not a standard Ryuk timeline.
How the 29-hour intrusion unfolded
The clock in The DFIR Report’s Ryuk’s Return starts with initial execution of Bazar, not merely the arrival of the email. Ryuk came later in the attack. The report describes the following sequence:
- Email link and Bazar execution. The initial email linked to Bazar, also called Kegtap in the report. The loader injected into processes including
explorer.exeandsvchost.exe, spawned command shells, and began discovery. - First reconnaissance phase. The operators used Windows utilities including
nltestandnet group, along with AdFind, to gather information about the environment. Activity then quieted. - Discovery resumed the next day. The operators returned to discovery tooling and used Rubeus. They sent discovery outputs by FTP to a server the report described as hosted in Russia.
- Lateral movement and an operational pivot. After a series of failed or incomplete lateral-movement attempts, the operators succeeded with SMB transfers and Cobalt Strike beacons. The report also observed remote WMI, PowerShell, and service execution. A domain controller became the main operational pivot.
- Defenses and backups were targeted. Before ransomware deployment, the operators used PowerShell to disable Windows Defender. They prepared the domain’s backup server first and stopped services including Veeam catalog, cloud, and deployment services.
- Ryuk deployment. The operators transferred Ryuk over SMB to the prepared backup server, then deployed the ransomware to other hosts through the environment from the domain-controller pivot.
The report’s summary says the campaign lasted 29 hours “from initial execution of the Bazar, to domain wide ransomware.” The endpoint was therefore domain-wide ransomware, not simply the first infected machine.
What’s actually slowing this PC down?
Pick the symptom - the matching free tool is one click away.
What the 29-hour figure does—and does not—measure
It is an elapsed time from Bazar execution to domain-wide ransomware in one incident documented by The DFIR Report on October 8, 2020. It is not a guaranteed warning period, an average for Ryuk incidents, or a measure of time from the email’s delivery. The observed pause after the first reconnaissance phase is part of this case’s chronology; it should not be assumed to occur in other intrusions.
#1 Best Overall
Why the first day of reconnaissance mattered
The DFIR Report estimated that defenders who missed the first day of reconnaissance in this incident would have had “a little over 3 hours” to respond before ransomware. That is the report’s case-specific estimate, not a general response window. The practical implication is that early discovery activity can matter: once operators have mapped the domain and begun remote execution, the remaining time may be short.
- Watch for unusual domain discovery using tools or commands such as
nltest,net group, and AdFind. - Investigate unexpected Rubeus use, beacon activity, and remote WMI, PowerShell, or service execution.
- Pay particular attention to unusual access to domain controllers and backup infrastructure, as well as attempts to disable endpoint protection or stop backup-related services.
These are defensive implications drawn from the reported chain, not controls demonstrated to have prevented this incident. The case report also contains historical infrastructure indicators and tool artifacts; their appearance in a 2020 account does not establish that they remain active or useful. Check indicators against current threat-intelligence sources before using them operationally.
Independent reader supportYour contribution helps us test, update, and keep practical guides available for everyone.Ransom demand and a separate Ryuk case
The DFIR Report described a demand of more than 600 bitcoins, which it valued at roughly $6 million or more at the time of publication. This is a reported demand and contemporaneous approximate valuation, not evidence that the ransom was paid or a current conversion. The report also repeated an FBI-attributed figure of $61 million paid to the group as of February 2020; that is a historical secondary attribution in the report, not an independently verified FBI release here.
Free tools Windows power users keep installed
One-click scans. No signup required.
Do not conflate this incident with The DFIR Report’s separate Ryuk in 5 Hours case, published October 18, 2020. That distinct intrusion reached domain-wide ransomware in five hours and used Zerologon (CVE-2020-1472). Zerologon is not part of the 29-hour Bazar-led sequence described above.
Quick Recap
Best Value
Rank #3
Product prices and availability are accurate as of the date/time indicated and are subject to change. Any price and availability information displayed on Amazon at the time of purchase will apply.
