A ransomware attack was stopped early at Constantia Pharmacy in Cape Town after cybersecurity forensic investigator Bruce Malaudzi spotted an infected, internet-exposed server and raced to warn the business, reports Cape town Etc .
Malaudzi found the system while threat hunting on the device search engine Shodan and noticed file names changing as encryption ran. Part of my job is threat hunting, he told MyBroadband .
He traced invoice files and database names to Constantia Pharmacy and found Windows file sharing enabled on root drives with no root password.
