The Siren That Never Went

Was just another BAU day at Duesseldorf Uni Lads in the IT room playing minesweeper and internet spades A few emails here and there RE: IT Support Needed I can't access my files Something's wrong with Citrix George stroke his beard Screw it, must be stupid SMB We should've stuck with UNIX "Something's going on", said Emery Anxiously searching Elastic Things are starting to look encrypted Gasps shouted across the room As they stared at the long ransom note Off went the not-so-classic ring tones on the IT admins' work phones Nicht das.. Nein! Swear words dropped on the white bricks As Emery ran across emergency Notepad.exe open with bitcoin addresses mocking her steps pass every screen PA's buzzing, an ambulance redirected The white van blazes towards Wuppertal It's whole thirty kilometers As the CRT screen rang A white line cut across the missed murder From a siren that never went ---------- In remembrance to the woman that died on September 9 2020, the first person that died directly due to a ransomware attack. She had to be redirected to a hospital in Wuppertal 19 miles (30 km) away and died in the ambulance on the way. The Siren that never went was the network intrusion detected too late. The IT department described is mostly fictional. Glossary BAU - Business As Usual minesweeper and internet spades - games built-in to Windows XP Citrix - popular and dirty commercial remote access software. It's remote code execution vulnerability allowed hackers to get in thousands of systems SMB - Server Message Block, the protocol used by Microsoft Windows networks to share files UNIX - A simple and secure operating system standard, implemented by BSD, MacOS, Solaris and some Linux distributions Elastic - ElasticSearch, a search engine often used in the ELK stack (Elastic,Logstash,Kibana) to search events and data across different network endpoints "Nicht das.. Nein!" - German for "not this.. no!" Notepad.exe - the program often used to display ransomware notes by cyber criminals bitcoin - a cryptocurrency that's hard to trace, often used by criminals to demand ransomware payments