Ransomware hunters: the self-taught tech geniuses fighting cybercrime

theguardian.com:

Around 9pm on Monday 23 November 2020, the IT manager for a school in central London received a text message from a colleague, saying the school’s website was down. He tried logging on but couldn’t. At first, he thought he had forgotten the password. After several attempts, he realised that he was locked out.

The IT manager, Matthew (he asked us not to use his last name), works in a central London neighbourhood where affluence hides pockets of poverty, and migrant families from Pakistan, India and eastern Europe pin their hopes for their children on a small, publicly funded school. It has about 150 students aged between five and 10, many of them on free school meals. On a shoestring budget, in a Victorian building that’s showing its age, teachers track the students’ progress by photographing them as they learn how to hold a pencil, draw a picture or write their name. The snapshots and other progress reports are uploaded to a server, a powerful computer that processes data and provides services for other devices used around the school.

An affable Englishman in his early 40s with blond hair and a stubble beard, Matthew has guarded this irreplaceable trove of data on every child’s learning since 2016. Although the school can only afford to pay him a few thousand pounds a year as a contractor, he is devoted to its people and mission. When he found he couldn’t access the website, he was desperate.

At 2am, having exhausted other ideas, he finally contacted the help desk of the company that hosted the server. He obtained a new server and connected it to the school. With the fresh setup, Matthew could see the files listed in the directories, though he still couldn’t open them. They had been renamed with the file extension