Rhysida Ransomware: Healthcare Network Intrusion

Before the clinical network can be trusted again, you need to know exactly how the attacker got in. The incident started with a remote-access session that should not have been permitted. Work out which account was used and why the normal second-factor check did not stop it.

The account that got in had two failed attempts before it succeeded. Separate those from the background of normal staff VPN sessions and identify the external address that established the malicious tunnel.

Once on the domain controller, the attacker extracted every domain password hash in a way that avoided touching the process most EDRs watch. Identify the ATT&CK technique that describes this method.

The attacker ran a persistent beacon on the jump host throughout the intrusion. Pinpoint the external address it was calling home to.

Before the encryptor ran, a large outbound transfer moved patient records off the network. Identify the external IP address that received the stolen data.

After extracting domain credentials from the DC, the attacker began moving laterally with a different account. Identify that account.

In the hour before encryption, the attacker ran a sequence of operations designed to ensure recovery would be impossible. Identify the MITRE ATT&CK technique that covers the core goal of that sequence.