ThreatLocker Interviews Explore Default-Deny Security and Ransomware Recovery
· 49:17 · Watch on YouTube ↗
Summary
In a ThreatLocker-sponsored episode, IT practitioners recount ransomware recovery and a hospital intrusion using purchased VPN credentials, illustrating application allowlisting, MFA and the risks of connected networks.
Key points
- An anonymous manufacturing IT leader reports that ransomware encrypted 250 Windows servers and affected about 350 endpoints in 15 minutes, halting business operations.
- The manufacturer chose a three-week infrastructure rebuild, checking backups and restored VMs, tracking device clearance and keeping Wi-Fi disabled until recovery was complete.
- Hunter Clark says attackers entered a hospital through its VPN using purchased domain administrator credentials; the hospital had declined MFA over budget and training concerns.
- According to Clark, ThreatLocker blocked attempted use of AnyDesk and rclone, but attackers pivoted through existing VPN tunnels to another hospital system without that protection.
- Clark reports that attackers claimed to hold terabytes of data and that the hospital system ultimately paid a ransom; the transcript does not independently verify the claimed data volume.
- The episode explains learning-mode baselining, application approval workflows and least-privilege controls. Danny Jenkins attributes tracked customer ransomware cases to unsecured systems or configuration gaps, rather than presenting independent efficacy testing.
Article Details
- Topics
- [02:16] Manufacturing ransomware incident and operational disruption
- [07:22] Backup validation, device rebuilding and phased recovery
- [13:33] Application allowlisting and ThreatLocker deployment
- [19:49] Hospital intrusion through compromised VPN credentials and missing MFA
- [24:17] Lateral movement across hospital VPN connections and ransom negotiations
- [26:51] ThreatLocker origins and default-deny application control
- [40:08] Layered defenses combining user awareness, detection and access controls
- [43:43] Vendor efficacy claims and configuration-related protection gaps
MITRE ATT&CK
T1078.002 · Domain AccountsHunter Clark reports that the hospital intruder used purchased credentials for a domain administrator account.T1133 · External Remote ServicesAccording to Hunter Clark, the intruder accessed the hospital environment through its internet-facing VPN without MFA.T1219 · Remote Access ToolsHunter Clark says ThreatLocker blocked AnyDesk, one of the applications the hospital intruder attempted to leverage.T1486 · Data Encrypted for ImpactThe manufacturing IT leader reports ransomware encryption of all 250 Windows servers within 15 minutes.
People
Danny JenkinsThreatLocker CEO and co-founder who discusses ransomware recovery work, developing application control and vendor claims about default-deny protection.Hunter ClarkCybersecurity engineer at Ark Technology Consultants who describes investigating a hospital intrusion and implementing endpoint security and zero-trust controls.
Malware
Vendors
Ark Technology Consultants[19:53] Ark Technology Consultants. My main focus is around endpoint security and how we canMalwarebytes[13:33] GUEST: [Music] We brought Malwarebytes, the enterprise platform version of Malwarebytes, andThreatLocker[00:03] gush about ThreatLocker. Why? Well, currently they’re my biggest sponsor,