FortiOS Bypass to Hunters International Ransomware

Overnight, the file shares at Norwick Outfitters came up encrypted and a ransom note was found. You have the FortiGate edge logs, the perimeter firewall, the Windows directory and endpoint records, and the endpoint process data for the affected servers. Work backwards from the impact to reconstruct how the operators got in, what they took, and how they locked the estate.

The edge appliance was the entry point. Work the FortiGate logs and isolate the external address that opened a privileged session and an SSL-VPN tunnel without going through a normal credential prompt.

Before moving on, the operators planted accounts so they could get back in even after a password reset. From the directory records, identify the rogue account that was created during the intrusion and added to the Administrators group.

The operators reached the internal servers without a second malware channel. Identify the server that was first reached by remote desktop from the remote-access tunnel.

The most important fact for the business is that data left the network before the files were locked. Reconstruct the egress and report the single external address the share data was uploaded to.

Only after the data had been stolen were the files locked. Map the final stage of this intrusion to its MITRE ATT&CK technique.