Lazarus: ManageEngine RCE to QuiteRAT Espionage
An internet-facing ManageEngine ServiceDesk Plus appliance at Caldermoor Networks, a regional network and internet service provider, falls to the unauthenticated SAML RCE (CVE-2022-47966). Code runs as the appliance service account, which curls down a QuiteRAT first-stage implant, profiles the host and domain, installs itself as an auto-start Windows service, and beacons to a single HTTPS C2 that carries control and stolen data alike before pulling a CollectionRAT second stage. Work the ManageEngine web logs, the endpoint process tree, and the perimeter egress to reconstruct the intrusion. North-Korea-nexus actor.
Start this operation
Investigation Tasks
Complete each task by investigating alerts and submitting your findings.
Triage the appliance alert
0An XDR detection has fired on the internet-facing ManageEngine ServiceDesk Plus server. Before chasing indicators, orient yourself: read the scenario, the correlation rules, and the endpoint process tree to understand what kind of intrusion this is.
Find the entry point
20Before any tooling ran, an external host reached the published ManageEngine instance and made it execute code without ever authenticating. Work the ManageEngine web access logs and isolate the external address behind the unauthenticated request that triggered server-side execution.
Recover the first-stage payload
20Right after the appliance ran code, it pulled a binary down from the internet and wrote it to disk. Work the endpoint process tree and the download activity, and identify the file name of the first-stage implant that was written to the host.
Expose the persistence
20The attacker did not rely on the running process surviving. They made the implant relaunch at every boot by registering it as a system service. Identify the name of the new service that was created for persistence.
Track the command channel
20Once persistent, the implant reached back out to its operator. Correlate the endpoint network activity with the perimeter egress and identify the single external address the implant used for command-and-control.
Classify the persistence technique
15The implant kept its foothold by registering itself as an auto-start system service rather than a run key or scheduled task. Map that persistence step to its MITRE ATT&CK technique.
6 tasks · 95 points total
Training Tools
Skills You'll Build
Requires foundational alert triage skills. Multiple data sources to correlate.
Prerequisites
- Basic understanding of security alerts
- Familiarity with SIEM concepts
- Familiarity with XDR concepts
- Familiarity with Firewall concepts
Ready to investigate?
More Operations
View allFinding Gozi: An Italian Malspam Infection
An accounts clerk at an Italian textile firm clicked an overdue-invoice link, downloaded a ZIP, and opened an Internet shortcut that reached out over SMB to pull a second-stage loader. PowerShell and rundll32 ran the Gozi banking trojan, and the workstation began beaconing to a rotating list of bare IP-literal hosts over plain HTTP. Trace the chain from a link-based lure through an SMB stage-2 fetch to the single command-and-control endpoint the trojan settled on, where it also shipped the stolen data.
From OneNote to RansomNote: A .one Attachment to Nokoyawa Ransomware
A phishing email carrying a malicious OneNote (.one) attachment delivered the IcedID loader, which beaconed quietly for weeks before the operator launched Cobalt Strike, enumerated Active Directory with AdFind, installed AnyDesk for redundancy, moved laterally over RDP, exfiltrated data over SFTP, and deployed Nokoyawa ransomware on the backup and file servers. Reconstruct the full kill chain from SIEM, endpoint XDR, and perimeter firewall telemetry, and classify the key ATT&CK techniques.
Lingering in the Background: BITS Job Used for Download and Persistence
A teller workstation was cleaned by antivirus, yet the operator's foothold survived. The malware had abused the Background Intelligent Transfer Service: a self-contained BITS job with a SetNotifyCmdLine notification command re-downloads a payload and re-launches it with regsvr32 every time a transfer completes, then deletes its tracks, leaving only the job entry inside the service state database. Reconstruct the persistence loop from BITS-Client operational events, Sysmon process lineage, and endpoint XDR telemetry, prove it outlived the file-based cleanup, and classify the key ATT&CK techniques.