Fake IP Scanner to BlackCat Ransomware
A multi-day, hands-on-keyboard intrusion that began with a malvertising lure for a popular network scanning utility and ended in enterprise-wide BlackCat ransomware. The trojanized installer side-loaded a malicious library to stage Sliver and Cobalt Strike, the operator dumped credentials living-off-the-land, moved laterally over SMB, exfiltrated data with a renamed Restic client to a dedicated host, then deleted shadow copies and encrypted the estate. Reconstruct the full kill chain from SIEM, endpoint XDR, and perimeter firewall telemetry, and classify the key ATT&CK techniques.
Start this operation
Investigation Tasks
Complete each task by investigating alerts and submitting your findings.
Incident brief
0Orient yourself before pivoting into the data. This is a no-answer briefing checkpoint.
Find the initial payload
35Every later event traces back to one execution on one workstation. Identify the file the user was tricked into running.
Classify the loader's execution-hijack technique
30The implants did not launch from an obviously malicious process. Identify the MITRE ATT&CK sub-technique for how attacker code first ran under a trusted binary.
Recover the harvested administrator
35The operator dumped credential memory and got a privileged account. Identify the account they recovered and reused.
Separate the exfiltration from the command channel
35The operator kept command and control and data theft on different infrastructure. Identify the external IP that received the exfiltrated data.
Classify the recovery-inhibition step
30Just before encryption the operator made sure the victim could not roll back. Classify what they did.
Recover the encryptor indicator
35Pin down the file-level indicator for the ransomware payload so it can be hunted. Provide the SHA-256 of the encryptor binary.
Classify the credential-access technique
30Name how the operator stole the privileged credential in the first place. Classify the credential-dumping technique used on the workstation.
8 tasks · 230 points total
Training Tools
Skills You'll Build
Complex multi-stage investigations. Realistic noise, ambiguous indicators, lateral movement.
Prerequisites
- Basic understanding of security alerts
- Experience with log analysis tools
- Familiarity with SIEM concepts
- Familiarity with XDR concepts
- Familiarity with Firewall concepts
Ready to investigate?
More Operations
View allCobalt Strike and SOCKS: 11 Days to LockBit
An eleven-day, hands-on-keyboard intrusion that began with a phishing message and ended in enterprise-wide LockBit ransomware. The operator hid a Cobalt Strike beacon in a trusted Windows process, ran a pair of SOCKS proxies for pivoting, dumped LSASS and the Active Directory database, and exfiltrated data to a cloud share and FTP drops before encrypting the estate. Reconstruct the full kill chain from SIEM, endpoint XDR, and perimeter firewall telemetry, and classify the key ATT&CK techniques.
Storm-0408: Malvertising Drops Lumma via GitHub
An after-hours visit to a pirated sports stream feeds a corporate workstation through a malvertising redirect chain that pulls a dropper from an abused public code-hosting service. A hidden PowerShell loader sets Run-key persistence and fetches the Lumma infostealer and a NetSupport RAT, which run through signed .NET living-off-the-land binaries to dodge application control. Lumma steals the browser credential store and exfiltrates it over HTTPS. Correlate proxy, Windows, XDR, and firewall telemetry to rebuild the chain from the ad redirect to the exfiltration endpoint and hand the team the indicators to contain it.
Three Gangs, One Affiliate: A Pre-Ransomware Intrusion
A five-day, hands-on-keyboard intrusion run by a single affiliate whose tooling overlaps with three ransomware operations, caught and evicted before any encryptor ran. The operator delivered a trojanized desktop utility, ran two parallel command channels, dumped LSASS, enumerated the domain, and exfiltrated a collection archive over FTP. Reconstruct the full pre-ransomware kill chain from SIEM, endpoint XDR, and perimeter firewall telemetry, and classify the key ATT&CK techniques.