Incident response and production hardening
Three infections, one framework CVE, a written board report in 48 hours.
The situation
A production server was compromised by three simultaneous infections — a crypto miner, a backdoor shell, and a credential scraper — all riding a framework CVE. Leadership needed the system back, a root cause, and language they could give a board.
What I built
A full incident response: isolate, analyze, clean, harden, and document. Not a vague “we secured it” — a timeline, impact assessment, and prevention steps in a report you can file.
How it worked
Traced each infection path, removed malicious artifacts, patched the framework, rotated credentials, applied kernel hardening, and configured Fail2ban. Reconstructed what logs allowed; noted what better logging would have shortened.
What shipped
Production restored within 48 hours. No evidence of data exfiltration found. Board report accepted and filed. Hardening measures left in place so the next CVE is not a free pass.
What I would tell the next client
Keep logs off the box you are trying to defend. Without external logs, reconstruction is guesswork with a stopwatch.