Problem: You are a member of the incident response team at Voluta Books Inc. At 4:30 on a Friday afternoon, you receive a call from Robert Guenther, the Director of IT for Karga Publishing, an organization that works with Voluta frequently.
He explains that for the last two weeks, their organization has been under attack. They have discovered that the source of the attack is using IP addresses that belong. to Voluta. The attacker has gained root access to a number of their servers, but they have not yet identified the method used to do so. The attack would have gone unnoticed except for some archives that were found in a strange location. They have correlated the activity to the time that Voluta servers were connected to the, nehvork.
The NSM consoles at Voluta have presented no alerts in relation to this attack.
Describe the actions you will take during the response, providing examples if necessary