During the recovery process, an unexpected resilience point was identified in a domain controller located in Ghana. This controller played a crucial role in enabling Maersk's recovery efforts, emphasizing the significance of maintaining offline backups. The threat actor, Sandworm, known for destructive attacks, was involved in the incident.