Executive Summary
A multinational SMB experienced a coordinated attack that disabled the client's firewall, wiped endpoints via PXE boot, and brought down all servers. Because the client had retained a third-party AV and had not adopted PremierePC's integrated EDR + NGAV and MXDR, our SIEM provided visibility after malicious actions executed, but we could not deliver real-time protection or containment.
PremierePC mobilized immediately. Within 48 hours, we:
- Replaced the neutralized firewall with a fully managed security appliance and activated advanced security services.
- Deployed our EDR + NGAV and MXDR across the environment.
- Performed external threat scanning to identify exposed assets.
- Restored servers from backup, stabilized identity and network controls, and implemented hardening baselines.
Post-incident, the environment operates on a cohesive security stack with a single accountable owner — PremierePC — eliminating the integration gaps that enabled the breach.
"The difference was night and day. PremierePC had us operational inside two days and left us measurably safer than before."
— CIO, Multinational SMB
Background
The client subscribed to core Managed IT services including helpdesk, patching, and SIEM. However, they chose to retain a third-party anti-virus solution and had not deployed PremierePC's integrated EDR, NGAV, or MXDR capabilities.
This partial adoption created blind spots:
- No real-time behavioral visibility or endpoint containment
- MXDR not active, so our team could not respond automatically
- SIEM alerts offered insight, but only after events had executed
Multiple IT vendors across different countries further fragmented change control, delaying response and increasing exposure.
The Incident
- Initial Compromise & Escalation: Adversaries circumvented/neutralized the firewall.
- Lateral Actions: Attackers gained control sufficient to trigger PXE boot workflows and wipe endpoints.
- Impact: All servers brought down; widespread endpoint impact across sites.
- Detection: Our SIEM observed indicators after execution, but without EDR/MXDR in place, there were no hooks for rapid containment.
Key Finding: The absence of integrated EDR + NGAV and MXDR removed the real-time prevention/response layer that would have blocked or contained the attack at multiple stages.
PremierePC Response (0-48 Hours)
Hour 0-4 — Initial Triage
- IR team assembled and secure communications established
- Isolated affected subnets and disabled untrusted PXE workflows
- Collected initial telemetry and artifacts
Hour 4-12 — Containment
- Deployed fully managed firewall with active security services: DNS filtering, intrusion prevention, and geo-blocking
- Ran external threat scan to locate exposed services and misconfigured DNS
- Applied segmentation and privileged access controls
Hour 12-24 — Recovery Prep
- Validated backup integrity and prioritized critical systems
- Began server restoration and gold image preparation
- Finalized endpoint policy groups for security tools
Hour 24-48 — Restore & Harden
- Restored production servers and confirmed data integrity
- Rolled out EDR + NGAV and connected endpoints to MXDR with 24x7 monitoring and response playbooks
- Hardened infrastructure (boot policies, GPOs, credential resets)
- Performed post-restore threat hunt and confirmed clean state
Outcome
What Would Have Prevented the Breach
PremierePC's EDR, NGAV, and MXDR were available in the service bundle but not implemented. These tools:
- Block malicious scripts, drivers, and lateral movement toolkits
- Isolate infected hosts automatically
- Correlate endpoint and network telemetry for live containment
Our RaaS platform (fully managed firewall + security service + external scanning) would have hardened the perimeter and identified exposures before they were exploited.
Why a Single Accountable Partner Matters
Fragmented IT environments with multiple vendors increase risk. With PremierePC now managing the entire environment:
- Policies are consistent and enforceable
- Changes follow governance workflows
- Security tools communicate across the stack
- There is no ambiguity about who is responsible for securing the environment
At-a-Glance
About PremierePC
PremierePC delivers integrated IT and cybersecurity services for SMBs with local and international operations. Our managed solutions unify security, support, and systems into a single accountable relationship — so your business can focus on growth, not threats.