How the Incident Unfolded
The initial compromise occurred on May 14, 2025, when an employee downloaded a malware-laced system administration tool from a spoofed website served via a Google Ads SEO poisoning campaign. On June 26, Symantec Endpoint Protection quarantined the malicious tool — but the backdoor it installed had persisted for 43 days by then.
Between August 5 and 15, the threat actor (TA) installed commercial remote monitoring software with keylogging and screen-recording capabilities on two user systems. On August 14, the TA deployed an encrypted tunnel that bypassed existing network controls, establishing direct RDP access. Between August 16 and 24, the TA moved laterally across critical servers via RDP, reached the password vault, retrieved credentials from 26 accounts, and cleared event logs to obscure the trail.
On August 24, the TA deleted backup volumes and changed security settings on the VM management server, then deployed ransomware at 01:30 AM PDT, encrypting the virtual environment. GTO detected the outage at 01:52 AM. By 07:37, the incident had been escalated to State CIO Timothy Galluzi and the Governor's Office. By 12:37, all affected VMs had been isolated. Legal counsel and Mandiant were engaged by 16:44 that afternoon. Recovery operations began the same day, at approximately 17:03. Mandiant was formally engaged August 26 on the cyber insurer's recommendation, with forensic analysis concluding September 9 and a final report delivered October 10.
Scope: 26,408 files were accessed; 3,241 were exposed. Of the files compressed and packaged for exfiltration in a six-part archive, one file containing personal information — belonging to a former employee — was identified, and that individual was notified per NRS 603A.220. The investigation found no confirmation to date of successful exfiltration or leak-site publication; monitoring continues.
What Determined the 28-Day Recovery
The AAR explicitly attributes the compressed recovery timeline to preparation, not to incident response improvisation. Several enabling factors drove the outcome, the most critical of which were in place before August 24.
Pre-Tested Incident Response Playbooks
The AAR describes the GTO's incident response playbooks as "thoroughly prepared and regularly tested," providing "a clear roadmap for containment and recovery" and "clear guidance during a time of crisis," and places them at the heart of the overall recovery. Business-critical services were restored within seven days of the attack. The State had also invested in annual cybersecurity incident response simulations, conducted across multiple agencies and leadership levels.
This matters because most state cybersecurity discussions focus on tools and technology. A playbook that has been drilled — and that assigns specific roles, escalation paths, and decision authorities — is operationally different from a plan that exists as a document. The question of whether people knew exactly what to do when systems went down at 1:30 AM on a Sunday is distinct from whether they had the right tools.
Pre-Established Vendor Relationships
On Day 0, legal counsel and Mandiant were engaged at 16:44. By Day 1, the GTO had activated Mandiant, Microsoft DART, Broadcom, and Dell under existing agreements. These were not emergency procurements; they were pre-established relationships activated under pre-negotiated contracts.
The vendor contributions were substantive and specific. Mandiant conducted forensics and incident response ($248,750). Microsoft DART led unified support and Active Directory infrastructure rebuild ($354,481). Aeris provided 24/7 recovery engineering support, including directly supporting the payroll processing cycle ($240,000). Dell recovered approximately 90% of the data over 28 days ($66,500). BakerHostetler handled legal and privacy counsel ($95,000). SHI/Palo Alto provided network security services ($69,400).
The AAR reports that Microsoft's DART team commended the state's rapid response as "among the most organized they had encountered." Dell highlighted "the seamless collaboration and the efficiency of the recovery efforts." These are vendor assessments as reported by the AAR, from organizations that handle major incident responses regularly.
An Explicit Service Prioritization Framework
The Governor's Office designated payroll as a top restoration priority. On Day 0, the Governor's Office, working with the State CIO, compiled an executive priority list using explicit criteria — life and safety, statutory and fiscal obligations, and public-facing continuity — and reaffirmed it daily throughout the response. The AAR describes the framework as adaptive: criteria were set, but the list was meant to be revisited as conditions changed.
The priority set included: Payroll/Advantage 2.0/Core.NV, the OEM recovery website, TANF/SNAP/Medicaid/Energy Assistance eligibility systems (Division of Social Services), CTAX and PCFP distributions, court administration, DMV customer-facing systems, Veterans Homes Electronic Medical Charting, the Mobile Crisis Hotline, the AG's legal tracking system, Victims of Crime programs, DPS Dispatch/Records/NTAC, and additional agency systems. The GTO isolated payroll processing, executed pre-run checks and post-run reconciliation during the incident, and no employee or retiree missed a paycheck during the 28-day recovery.
An explicit priority list built from documented criteria produces different outcomes than one negotiated under pressure. The Nevada framework's strength was that it was grounded in criteria — life and safety, statutory and fiscal obligations, public-facing continuity — that gave technical teams a coherent basis for allocating effort rather than responding to the loudest stakeholder at any given hour.
Communications Discipline: "Execute, Then Communicate"
The GTO adopted a specific communications protocol during the incident: announce milestones only after controls are live, not when planned. The AAR describes this as an "execute, then communicate" framework. A single Recovery Hub (oem.nv.gov/recovery) served as the designated source of truth. Pre-assigned spokespersons handled public communications. A four-question gate governed each public release.
The AAR's stated rationale for this approach concerns security: after early briefings, firewall blocks and phishing attempts increased, and sequencing communications after controls were live reduced attacker advantage. The Governor's Office was specifically assigned responsibility for public reassurances, as a distinct function from technical milestone announcements.
What the Attack Revealed and What GTO Is Fixing
The AAR documents several gaps the incident exposed. The GTO has identified a need to move from a decentralized to a hybrid centralized SOC model with unified endpoint detection and response (EDR) coverage. The TA operated for more than 100 days before the ransomware deployed — a dwell time the AAR addresses by committing to centralized SOC monitoring that will reduce detection latency. That commitment has since been enacted: AB 1 of Nevada's 36th Special Session (session adjourned November 19, 2025) created the Security Operations Center within the Office of Information Security and Cyber Defense by statute. The law requires the SOC to provide every state agency and elected state officer with cybersecurity services including real-time monitoring, threat mitigation, incident response, and enforcement, and made appropriations to the GTO for cybersecurity investments and created a dedicated Account for the SOC. Local entities may opt in by agreement. The SOC is no longer just an AAR plan — it is a statutory requirement.
On the identity and access side: the TA's lateral movement via RDP and credential harvesting from the password vault led to a remediation list in the AAR — excess privileges removed, Tier 0 and just-in-time controls being implemented — indicating those controls were incomplete at the time of the attack. The GTO's future-state plan includes just-in-time administration via PIM and PAM solutions, strong authentication (passwordless login, FIDO, Microsoft Entra MFA), and disabling legacy protocols — SMBv1, NTLM, TLS 1.0 and 1.1 — along with legacy services including SMTP, Telnet, FTP, and IMAP, which are being updated to secure alternatives.
The backup architecture also failed in the way that matters most: the TA deleted backup volumes before deploying ransomware. The post-incident plan addresses backup isolation but the AAR does not detail the specific backup architecture changes — it focuses on the recovery outcomes (Dell's 90% data recovery) rather than the new backup posture. This is worth noting: the AAR is a candid document, but it is a recovery story, not a full vulnerability disclosure.
The Cost Argument for Recovery Readiness
Combining the AAR's fully loaded overtime estimate ($259,037.84) and vendor costs obligated to date ($1,314,200) gives about $1.57 million; the AAR does not report a total incident cost figure. The overtime figure covers 4,212 hours by 50 employees over the response period. The AAR notes that the equivalent contractor cost for the same OT at $175/hour would have been roughly $737,100 — implying estimated savings of $478,062.16 from maintaining an in-house surge capability.
The AAR makes an explicit argument for paying vendors rather than a ransom: "These dollars went to trusted, expert partners who resolved the immediate crisis and left the State with a hardened, more defensible environment." The report frames that choice as "fiscally responsible." The cost of a prepared response — maintained vendor relationships, regularly drilled playbooks, pre-negotiated retainer agreements — is predictable. The absence of pre-established relationships adds both time and cost pressure at the worst possible moment.
No ransom was paid. The AAR attributes this directly to the state's "confidence in its recovery capabilities." That confidence was not aspirational; it was grounded in the same playbooks and vendor relationships described above.
A Recovery Readiness Audit for State CISOs
The Nevada AAR provides a checklist in observable form: the capabilities that were present in Nevada when the incident hit are the same capabilities most states should audit before their own incident.
Incident response playbooks: Do your agency playbooks include ransomware-specific scenarios? Have they been drilled with the specific personnel who would execute them, including at off-hours? A playbook reviewed annually but never simulated will not perform like one that was drilled six months ago.
Vendor retainer agreements: Which IR, forensics, and legal vendors are under retainer or on a pre-qualified roster? Can you activate them in hours, or does activation require a procurement action? Emergency procurement during an active incident is a recoverable problem — but the absence of pre-established relationships adds friction at exactly the wrong moment.
Service prioritization framework: If ransomware deployed tonight and you had to restore systems in sequence, what is your priority order? Is it documented and known by both IT leadership and executive leadership, or would it be negotiated under pressure? The Nevada priority set (payroll, OEM recovery site, benefits eligibility, distributions, court, DMV, veterans charting, crisis line, DPS dispatch, legal tracking) reflects the state's specific statutory and service obligations; your state's list will differ, but it needs criteria — life and safety, statutory obligations, public-facing continuity — that hold up under Day 0 pressure.
Backup isolation architecture: Can your backup volumes be deleted by a threat actor who has compromised your Active Directory? In Nevada, deleting backups was the attacker's last step before encryption. Air-gapped or vault-protected backups with their own access controls are not optional.
Crisis communications protocol: Who announces what, when, and through what channel? Is there a designated single source of truth for public updates? Who has authority to clear a statement before it goes out? Nevada's four-question gate and oem.nv.gov/recovery site are replicable structures that any state CIO can establish in advance.
Sources and further reading
- After-Action Report — 2025 Statewide Cyber Incident, State of Nevada Governor's Technology Office, authored by Info-Tech Research Group (Mark A. Hellbusch, Director, Cybersecurity & Privacy Services), dated October 28, 2025, released November 5, 2025
- AB 1, Nevada 36th Special Session (2025), enrolled text — creates the Security Operations Center within OISCD
Spartan X has provided advisory and platform delivery to state government leadership across multiple states, including engagements that required building governance and technical architecture across agency boundaries under real operational constraints. Recovery readiness — the systems, vendor relationships, and decision frameworks that determine how quickly a state can restore critical services — is the kind of multi-agency coordination problem where preparation time and architecture decisions made before an incident determine what is achievable after one. That work includes cybersecurity advisory, continuous monitoring, and enterprise security architecture for state agencies.
