At Logistique Sahel Atlas, every operations file ends up as “.lsa3” and the encryption goes on

Logistique Sahel Atlas (LSA) runs three cold-storage warehouses in Agadir and plans the trucks' rounds to Marrakech and Casablanca every night. The loading plans, delivery notes and temperature sheets live on the exploitation share of the server srv-fichiers (Samba, member of the domain LSA.LAN managed by dc-01). A copy is made every hour to the NAS nas-01 (SMB share mounted on srv-fichiers), and every 6 hours sauv-01 sends a restic snapshot to a MinIO object storage s3-immuable with Object Lock (set up in March after an audit). Workstations and servers forward their logs to Wazuh (wazuh-01).

This morning at 07:30, the day team finds hundreds of files renamed to .lsa3 and a file LISEZ-MOI-LSA3.txt in every folder. The 09:00 trucks have no loading plan. The director wants to “restore everything from the NAS, right now”, the accounting manager swears his PC “has been off since last night”.

You are the on-call SOC analyst, on poste-soc, with root SSH access to the servers. Your mission: contain (stop the encryption at its source, neutralise the access being used), identify the source workstation in the logs, then restore the last clean state from the immutable copy. No offensive action: you do not “counter-attack”, you contain and you restore.