In early 2026, a Polish hospital network fell victim to an advanced ransomware attack that paralyzed its IT systems for more than 72 hours. In this analysis we break the incident down to its fundamentals — from the initial access vector, through privilege escalation, all the way to full remediation.
TL;DR - Key takeaways
- Initial Access Vector: Spear-Phishing the HR Department
- Lateral Movement and Privilege Escalation
- Detonation and Business Impact
- Remediation and Lessons Learned
1. Initial Access Vector: Spear-Phishing the HR Department
The attackers sent a carefully crafted email to an HR employee, posing as a candidate applying for an open position. The attachment was a .docx file with an embedded VBA macro that, once enabled, pulled a payload from an external C2 server.
The macro used a "Living off the Land" technique — instead of downloading a suspicious .exe file, it launched a PowerShell script that opened a reverse shell to the attackers’ infrastructure. Antivirus did not react, because the script wrote nothing to disk (a fileless attack).
The Critical Mistake
VBA macros were enabled by default on workstations. Simply disabling macros for documents originating outside trusted locations would have blocked this vector.
2. Lateral Movement and Privilege Escalation
After gaining access to the workstation, the attackers ran internal network reconnaissance using tools such as BloodHound and SharpHound. Within 4 hours they identified a service account with Domain Admin privileges whose password had been set in 2019 and never changed.
The service account had no MFA (multi-factor authentication) enabled and held the right to log in on domain controllers. The attackers gained full access to Active Directory in under 6 hours from the first click on the attachment.
3. Detonation and Business Impact
The ransomware (a LockBit 3.0 variant) was executed simultaneously on 47 servers and 312 workstations. Among the encrypted systems were the electronic medical records (EMR) platform, the patient queuing system, email, and the backups stored on network shares.
The hospitals had to switch to paper records. Elective procedures were canceled for 3 days, and patients requiring urgent diagnostics were redirected to other facilities.
What Would Have Helped
Network micro-segmentation and air-gapped offline backups would have spared the organization such a catastrophic impact. Attackers should never have been able to reach production servers from the office segment.
4. Remediation and Lessons Learned
The incident response team (internal + external) needed 72 hours to fully contain the threat, restore systems from backups (partially intact tape copies), and carry out the forensic analysis.
- Disable VBA macros for documents from untrusted sources.
- Rotate all service-account passwords and enforce MFA on privileged accounts.
- Segment the network — separate the administrative IT segment from medical systems.
- Deploy air-gapped backups with a tested restore process.
- Run regular penetration tests and tabletop exercises simulating ransomware.
Summary
This incident shows that even an advanced ransomware attack starts with a simple mistake — here, enabled macros and an old service-account password. Defense in depth is not a luxury; it is a necessity.