Removing a phishing Trojan and hardening a retailer’s network

What happened

A retail client received what looked like a payment receipt from a customer, claiming they had paid by bank transfer. Something about it didn’t feel right, and the client was worried their systems might have been compromised, so they called us.

Our investigation found signs that their systems had been infected with malicious software: a phishing Trojan, designed to give attackers a way into the business. That put sensitive customer data, financial information and the day-to-day running of the business at serious risk. The client needed the threat removed quickly, and confidence that it couldn’t happen again.

How we responded

We worked in two stages: first remove the immediate threat, then put long-term protection in place. Throughout, we followed the controls set out in Cyber Essentials, the UK government-backed scheme for protecting organisations against common cyber attacks.

1. Removing the threat

We identified the infected systems, removed the Trojan and scanned every device for other malware, so the client could be sure their systems were clean before moving on.

2. Securing the network

We installed a Ubiquiti UDR 7 firewall, giving the business real-time monitoring of network activity and filtering of suspicious traffic. For the first time, the client could see what was happening on their network and be alerted to anything unusual.

3. Protecting every device

We deployed Bitdefender security across all computers and mobile devices, giving ongoing protection against malware and phishing attempts wherever staff were working.

4. Secure remote access

We set up a NordLayer VPN, so staff working away from the shop connect to business systems over an encrypted connection rather than an open internet connection.

5. Stronger passwords

We rolled out the Keeper password manager across the team. Every account now has a strong, unique password, logins can be shared securely, and access can be removed in one step when someone leaves.

The result

• The Trojan was removed and all affected systems were cleaned and secured.
• Real-time visibility: the client can now see network activity and receives alerts about anything suspicious.
• A much stronger security posture, with layered protection across the network, every device, remote access and passwords, significantly reducing the risk of future phishing and malware attacks.
• Confidence for the team, who know their systems are protected by proven security tools.

What other businesses can learn

This attack began with a single convincing document. Phishing is now the most common way attackers get into small businesses, and the messages are increasingly hard to spot. A few habits make a real difference:

• Treat unexpected payment documents with suspicion, and check them with the sender using contact details you already have.
• Don’t rely on antivirus alone. A firewall, device protection, secure remote access and a password manager each close a different gap.
• Act quickly when something feels wrong. Calling for help early, as this client did, limits the damage.

Our five-minute security check is a good place to start. If you’d like us to review your set-up or help after an incident, our IT support service covers security as standard.