FortiOS Bypass to Hunters International Ransomware
Operators consistent with the Hunters International ransomware group abuse a FortiOS super-admin authentication bypass on an internet-facing FortiGate, plant rogue accounts, pivot over the SSL-VPN tunnel by RDP, sweep the network with Advanced IP and Port Scanner, and push roughly 6.8 GB of share data to a single external host over SFTP before running the encrypter. Work the FortiGate edge, the directory records, the perimeter egress, and the endpoint process tree to reconstruct the intrusion from entry to encryption.
Start this operation
Investigation Tasks
Complete each task by investigating alerts and submitting your findings.
Triage brief
0Overnight, the file shares at Norwick Outfitters came up encrypted and a ransom note was found. You have the FortiGate edge logs, the perimeter firewall, the Windows directory and endpoint records, and the endpoint process data for the affected servers. Work backwards from the impact to reconstruct how the operators got in, what they took, and how they locked the estate.
Pin the way in
20The edge appliance was the entry point. Work the FortiGate logs and isolate the external address that opened a privileged session and an SSL-VPN tunnel without going through a normal credential prompt.
Find the account they left behind
20Before moving on, the operators planted accounts so they could get back in even after a password reset. From the directory records, identify the rogue account that was created during the intrusion and added to the Administrators group.
Trace the pivot
20The operators reached the internal servers without a second malware channel. Identify the server that was first reached by remote desktop from the remote-access tunnel.
Follow the data out
20The most important fact for the business is that data left the network before the files were locked. Reconstruct the egress and report the single external address the share data was uploaded to.
Classify the impact
15Only after the data had been stolen were the files locked. Map the final stage of this intrusion to its MITRE ATT&CK technique.
6 tasks · 95 points total
Training Tools
Skills You'll Build
Ideal for newcomers to SOC operations. Guided investigation with clear indicators.
Prerequisites
- No prior experience required
- Familiarity with SIEM concepts
- Familiarity with Firewall concepts
- Familiarity with XDR concepts
Ready to investigate?
More Operations
View allThe Template That Read the Disk
The file-transfer portal that Tideglow Logistics' partners upload to spent a morning returning host files it was never meant to publish, and finished it running an administrator session nobody had logged into. The root cause is CVE-2024-4040 in CrushFTP 10.6.0. Walk the access logs and firewall traffic step by step to trace how a client holding no credentials turned a request parameter into a read of the host, and that read into a takeover.
OneNote Attachment to RAT: A Guided First Investigation
A logistics contracts employee at Glacierline Freight opens an attachment that arrived in her inbox and clicks a button inside it. Minutes later her workstation is running something that appears on no software inventory and is talking to a host that no business process uses. Walk the email gateway records, the file artifacts and the endpoint process tree one step at a time, and work out for yourself which message carried the delivery, what landed on disk, and what ran.
Hijacked Discord Invite to ClickFix Loader: Tracing the Lure
A finance analyst at Halcyon Wealth Partners followed a recycled Discord invite that quietly redirected the browser to a fake verification page. They did what the page asked, and inside the hour the workstation was running a remote-access trojan alongside an info-stealer that shipped browser data straight out of the building. Walk the proxy, endpoint and firewall evidence step by step to trace the lure, the loader, the C2 beacon and the data theft.