FluBot: The Parcel-Delivery Text That Spreads Itself
A managed Android handset at Larkfield Mutual is infected by FluBot after the employee taps a smishing SMS impersonating a DHL parcel-delivery notice. The fake tracking page talks the user into installing an app and granting it Accessibility and SMS permissions; from there the trojan turns the phone into a sender, harvesting the contact list, texting the same lure onward and intercepting bank 2FA codes, while keeping a command channel the perimeter firewall never blocked. Walk the mobile telemetry and firewall logs step by step to trace the lure, the sideload, the contact theft, the SMS worm, and the hidden C2.
Start this operation
Investigation Tasks
Complete each task by investigating alerts and submitting your findings.
Brief: a parcel text that texts itself
0A managed company phone started sending text messages of its own this morning, after its owner tapped a parcel-delivery link. Before you dig into the logs, get oriented on how this kind of mobile malware works.
Find the link the victim tapped
15The whole infection began with one text message containing a web link disguised as a parcel-tracking page. Find the domain that link pointed to.
Name the app that was sideloaded
15Tapping the link led to an app download from outside the managed store. Identify the exact filename of the package that landed on the phone.
Spot where the stolen contacts went
15Once installed, the trojan read the entire contact list and reached out to its command server to send them off. Identify the command-and-control domain it contacted.
Measure how far it tried to spread
10FluBot's signature behavior is turning a victim into a sender. The handset began blasting the same lure to its own contacts. Determine how many messages it sent in that burst.
Label how the C2 stayed hidden
10The firewall never blocked the command-and-control traffic because of how the trojan disguised it. Map that evasion technique to MITRE ATT&CK.
6 tasks · 65 points total
Training Tools
Skills You'll Build
Ideal for newcomers to SOC operations. Guided investigation with clear indicators.
Prerequisites
- No prior experience required
- Familiarity with SIEM concepts
- Familiarity with Firewall concepts
Ready to investigate?
More Operations
View allThe Template That Read the Disk
The file-transfer portal that Tideglow Logistics' partners upload to spent a morning returning host files it was never meant to publish, and finished it running an administrator session nobody had logged into. The root cause is CVE-2024-4040 in CrushFTP 10.6.0. Walk the access logs and firewall traffic step by step to trace how a client holding no credentials turned a request parameter into a read of the host, and that read into a takeover.
OneNote Attachment to RAT: A Guided First Investigation
A logistics contracts employee at Glacierline Freight opens an attachment that arrived in her inbox and clicks a button inside it. Minutes later her workstation is running something that appears on no software inventory and is talking to a host that no business process uses. Walk the email gateway records, the file artifacts and the endpoint process tree one step at a time, and work out for yourself which message carried the delivery, what landed on disk, and what ran.
Hijacked Discord Invite to ClickFix Loader: Tracing the Lure
A finance analyst at Halcyon Wealth Partners followed a recycled Discord invite that quietly redirected the browser to a fake verification page. They did what the page asked, and inside the hour the workstation was running a remote-access trojan alongside an info-stealer that shipped browser data straight out of the building. Walk the proxy, endpoint and firewall evidence step by step to trace the lure, the loader, the C2 beacon and the data theft.