SASE
SASE Case Practice: Fiberlink Blocks OA Ransomware in 3 Hours, Fortifying Security for a Large Cross-Border Trading Company
Nov.28.2025

Headquartered in Jiangsu Province, this large-scale import and export trading company generates an annual revenue exceeding RMB 300 million, focusing on the import and export of textiles, garments, pet products, and other commodities. It operates 6 branch offices with approximately 600 employees, and its overseas customers are distributed across multiple countries. As business expands, the enterprise faces three key challenges in cross-border operations: long-term saturated cross-border bandwidth impairing operational efficiency, lack of real-time security early warning capabilities, and security pressures stemming from data transmission compliance requirements across multiple regions. The traditional "self-built + passive defense" model can no longer meet the needs of the enterprise's global development.


Fiberlink's SASE Security Solution

To address the aforementioned challenges, Fiberlink deployed an integrated solution centered on SASE for the customer, achieving synchronized upgrades in cross-border access acceleration and security capabilities.
The solution adopts an intelligent traffic diversion strategy: local office traffic is prioritized for transmission through local gateways, while cross-border business traffic (e.g., involving overseas operations) is connected to nearby PoP nodes for optimal path forwarding. This enhances the stability of cross-border access and supports temporary bandwidth expansion to alleviate link pressures during peak foreign trade seasons.
Meanwhile, the SASE gateway is equipped with intrusion detection and access security functions, enabling real-time identification of abnormal behaviors, potential viruses, and external attacks. Combined with continuous monitoring, alerting, and remote assistance from Fiberlink's operation and maintenance team, it provides enterprises with 24/7 professional security protection.
In terms of operational experience, the enterprise can receive real-time alerts via WeChat Official Account and access weekly report summaries, gaining comprehensive visibility into security postures to support management decision-making.

However, what truly made the enterprise recognize the value of "proactive security operations" was an OA system ransomware attack that occurred on November 10, 2025. Notably, the customer's team was unaware that the OA system had been compromised, but Fiberlink's security team detected abnormal traffic in advance through the backend. Within the subsequent 2 hours, the team launched an emergency response, successfully restoring the system to normal operation and preventing significant losses.


Fiberlink Takes Proactive Action to Block Ransomware – Turning Security Awareness from "Non-Existent" to "Proactive"

During the OA system ransomware attack, Fiberlink's cybersecurity protection backend captured abnormal attack traffic in real time and quickly identified multiple high-risk vulnerability characteristics, including deserialization exploitation and arbitrary file uploads.
Immediately afterward, Fiberlink took the initiative to contact the enterprise to confirm the system status, clarifying that the core data of the enterprise's OA system had been encrypted and held for ransom.
Once the risk was identified, the enterprise, under the guidance of Fiberlink's technical team, promptly implemented key blocking measures: banning major malicious IPs, closing high-risk external ports, and isolating infected hosts. This successfully achieved the rapid interruption of the attack chain, preventing the threat from spreading further to core systems such as finance and business operations.

After the situation stabilized, Fiberlink's operation and maintenance team conducted a retrospective analysis of the attack path, issued a hardening plan covering patch upgrades, access policies, and security baselines, and assisted the enterprise in system reconstruction and data recovery. As a result, the overall losses were controlled within a manageable range.


In the five months since the solution was deployed, F-Guard has processed 18,634 original alerts, aggregated into 12,001 security events. Among these, 11,801 were automatically blocked by the system, achieving a blocking rate of up to 99%. Threats including 3,547 external attack sources, 8 compromised hosts, and 4 malicious files were all proactively addressed. Over the past 30 days, the enterprise has reported no new compromised hosts or malicious files, and the overall threat posture has continued to decline. This fully demonstrates the high adaptability and continuous protection capabilities of the SASE solution for cross-border enterprises.


Before vs. After Using Fiberlink's Security Solution

Dimensions Before Deployment After Deployment
Cross-Border Access Saturated bandwidth, unstable connections Optimized path forwarding, stable access
Security Defense Passive defense, delayed threat detection Proactive monitoring, real-time blocking
Compliance Capability High compliance risks for cross-border data Meets multi-region data transmission compliance requirements
Operational Visibility Limited security posture awareness Real-time alerts + weekly reports, full visibility
Threat Handling Efficiency Slow response, potential for large losses 3-hour emergency response, minimal losses


Stable Digital Layout

On the path of global digital transformation, cross-border network performance and security operation capabilities are the core competitiveness of enterprise development. Fiberlink's "Worry-Free Acceleration + Always-On Security" solution, centered on SASE, builds a stable, visible, and predictable security system for enterprises, enabling cross-border businesses to advance steadily in the global market and providing a solid cybersecurity foundation for enterprises' digital transformation.


Translation Notes

  1. Terminology Consistency: Key technical terms (SASE, PoP nodes, deserialization exploitation, security baselines) adhere to global industry standards. Brand-related terms (Fiberlink, F-Guard) are retained as official names.
  2. Business Context Adaptation: Expressions like "annual revenue exceeding RMB 300 million" and "Worry-Free Acceleration + Always-On Security" are optimized for international business communication, balancing accuracy and marketing appeal.
  3. Sentence Structure Optimization: Long Chinese sentences are split into concise English structures, with passive voice appropriately converted to active voice (e.g., "was encrypted and held for ransom") to enhance readability.
  4. Cultural Localization: "WeChat Official Account" is used instead of literal translation to clarify the platform identity. "Branch offices" accurately reflects the enterprise's organizational structure.
  5. Data Presentation: Numerical data (99% blocking rate, 3-hour response) is highlighted with front-positioned numerals to emphasize core advantages, aligning with international case study writing conventions.


  • Trust
    Huawei's preferred MSP
  • Major
    Many to one system
  • Hassel free
    Exclusive Engineer Services
  • Standardization
    One-stop implementation services
  • Intellectualization
    Intelligent robot operation and maintenance
  • Visualization
    7-by-24 hour monitoring center