Mammoth Electric – Case Study: From IT Chaos and Ransomware Recovery to a Secure, Scalable Foundation
The Problem:
The Problem Mammoth Electric faced significant IT challenges following a leadership transition, including an undocumented and uncontrolled environment with limited visibility and no structured support. These vulnerabilities culminated in a severe ransomware attack, that compromised the entire Active Directory forest, encrypted servers and endpoints, and deleted Volume Shadow Copies.
When new leadership assumed oversight, they inherited an opaque IT environment. Access was controlled by a prior provider, documentation was nonexistent, and there was minimal visibility into systems, applications, or infrastructure. Day-to-day operational issues mounted without a reliable support process.
These weaknesses were exploited in a full-domain ransomware attack. The incident resulted in widespread encryption of servers and endpoints (including three critical Hyper-V host servers), deletion of Volume Shadow Copies, and complete compromise of the Active Directory forest with administrative privileges exploited. The attack halted operations and exposed the organization to prolonged downtime and security risks.
The Solution:
Partnering with Consiliant Technologies, Mammoth Electric regained full control, contained the breach, and executed a comprehensive recovery and modernization effort.
Consiliant provided continuous on-site and remote support, restoring critical systems while implementing enhanced security measures.
Consiliant immediately assumed ownership of the IT environment, restoring administrative access and initiating a structured recovery with around-the-clock support. Key recovery and remediation activities included:
- Immediate containment to prevent further spread of the ransomware.
- Investigation and forensics to determine the scope and entry method.
- Backup recovery from the most recent clean backups.
- Server restoration and rebuilding of critical systems.
- Endpoint re-imaging of all affected workstations.
- Active Directory recovery with metadata cleanup and restoration of a clean domain
environment. - Deployment of a new secondary Domain Controller.
- Modernization of Active Directory replication from NTFRS to DFSR.
- Full rebuild of the VDI server and up to 22 virtual machines.
- Implementation of Ninja Remote as a secure, MFA-enforced managed service for remote
and hybrid users. - Hardening, validation, and thorough testing of systems.
- Coordination with cyber insurance providers and cybersecurity advisors.
Due to the depth of the privileged compromise (domain administrator access) and per NIST SP 800-61 and SP 800-83 guidelines, along with CIS Incident Response recommendations, systems with this level of compromise must be considered untrusted. Reusing the hardware would risk persistent malware, firmware tampering, corrupted configurations, and violations of Microsoft Hyper-V best practices.
Replacement with new Dell servers and storage was therefore required to re-establish a trusted, secure foundation for the production virtualized environment. This was not an upgrade but a necessary restoration of a supported, secure baseline.
Immediate loaner servers were deployed to maintain business continuity while replacement hardware was ordered and delivered, allowing the environment to be restored quickly without utilizing the compromised legacy infrastructure.
In parallel, Consiliant conducted a full discovery of systems and applications, standardized the environment, upgraded infrastructure, and implemented a centralized ticketing system for efficient issue management.
The Result:
Mammoth Electric now operates on a significantly more resilient IT foundation:
- Full administrative control restored.
- The IT environment is documented, standardized, and modernized.
- Infrastructure upgrades, including replacement of the three compromised Hyper-V hosts, have improved performance, reliability, and security.
- A centralized support system has accelerated issue resolution and enhanced user experience.
- Leadership has clear visibility and proactive IT management that supports business continuity and growth.
“The transition from reactive “firefighting” to a structured, secure operation was completed in core areas. To finalize the secure rebuild and prevent future incidents, the following procurements were essential: Dell Servers and Storage, Microsoft Licensing, and Ongoing Ransomware Recovery Support.
These investments ensured all systems were fully restored, hardened, and positioned for scalability. Key proof points included full administrative control restored within days, successful Active Directory forest recovery and modernization, complete VDI rebuild, deployment of secure remote access with MFA, and a shift to proactive managed services.”
Quotes:
“Consiliant worked around the clock, and it was due to your outstanding service that we at Mammoth were able to get back online and resume business. On behalf of our CEO and myself, I wanted to let you all know how thankful we are for your professionalism and outstanding work in helping Mammoth during this situation. Thank you for your fast-acting response upon learning of the suspicious activity going on with our system.”
— Kathy Crawford, Controller Mammoth Electric
“The ransomware attack on Mammoth Electric was a stark reminder of how quickly an undocumented and under-supported IT environment can bring operations to a halt. Our team moved with urgency and precision—restoring administrative control within days, rebuilding a clean Active Directory environment, replacing the compromised Hyper-V hosts with a secure foundation, and implementing modern tools like MFA-protected Ninja Remote. What stands out most is the trust Mammoth placed in us during their most critical moment. Today, they’ve transitioned from reactive chaos to a documented, standardized, and scalable IT infrastructure that supports their growth with confidence. This engagement exemplifies why Consiliant exists: to deliver not just recovery, but a stronger, more resilient future for our clients. We’re proud to stand with Mammoth Electric as their trusted technology partner.”
– Dave Cerniglia, CEO Consiliant Technologies”
