Cactus Ransomware: Qlik Sense Exploitation

An internet-facing analytics server began behaving like a workstation in an attacker's hands overnight, and by morning shares across the estate were encrypted. Start at the edge: determine the external address that reached the analytics platform and drove the intrusion.

Reaching the server is not the same as running on it. One process lineage proves the exploit turned into execution. Identify the host where a background analytics service was caught spawning an interactive shell.

This estate runs several legitimate remote-access and remote-management tools all day. After gaining execution, the operator installed one more for persistence that does not belong. Identify the remote-access agent the attacker installed.

To move beyond the foothold the operator needed privileged credentials and took them from memory. Identify the account the attacker harvested and then reused to move across the estate.

With the stolen account the operator fanned out from the analytics host. One destination matters most because it controls the whole domain. Identify the host the attacker reached that is the domain's control point.

Before the ransomware fired, data was copied out of the network for extortion. Identify the external host the stolen data was transferred to.

Just before encryption, the operator made sure the victim could not roll back. Map that anti-recovery activity to the MITRE ATT&CK technique it represents.

When the encryptor ran, it rewrote the file-server data. Identify the file extension the encryptor appended to every file it encrypted, the on-disk signature that confirms the strain.