Ransomware is targeting more and more organizations. As part of the Truesec incident response team one of the things we always see is the need to track down patient zero and be sure that no remnants of the threat actor is still active in the environment. To do this our team of cyber security forensics will use logs to follow the trail where ever it may lead.