Salt Typhoon: Telecom Carrier Espionage
An Axiom Carrier Services edge router is behaving in ways its change record cannot explain: management sessions from addresses that should never reach it, a configuration change with no ticket behind it, and egress the estate never authorised. Work a full day of router syslog and perimeter firewall traffic and reconstruct what happened to the device, in order.
Start this operation
Investigation Tasks
Complete each task by investigating alerts and submitting your findings.
Locate the initial access vector
35A carrier edge router is behaving in ways it should not: connections from unexpected external sources, unusual processes, and logs that do not match any approved change window. Establish how the attacker first touched the device.
Identify the backdoor account
30Immediately after the exploit request, a new local account appeared on the router that does not exist in the TACACS+ authentication database. Name that account.
Confirm the persistence mechanism
35Beyond the backdoor account, the attacker planted something that survives a router reload. Identify the full path of the implant written to flash storage.
Trace the primary C2 channel
35With persistence in place, the implant establishes a command-and-control connection. Determine the domain name the implant connects to for its primary C2 channel.
Classify the secondary C2 technique
30The implant used more than one route out to its operator. Identify the MITRE ATT&CK technique covering the second of them.
Identify the transport of the unauthorised core-switch flow
25One flow left the carrier core switch for an external host during the morning. Identify the protocol it used on the wire.
Pin down the exfiltration endpoint
35Late in the session the backdoor account assembled a compressed archive on the router and sent it out. Identify the external IP address that received it.
Attribute the credential access technique
35Shortly before that archive was assembled, the backdoor account ran a single command on the router. Identify the MITRE ATT&CK credential access technique that covers what its output put within reach.
8 tasks · 260 points total
Training Tools
Skills You'll Build
Complex multi-stage investigations. Realistic noise, ambiguous indicators, lateral movement.
Prerequisites
- Basic understanding of security alerts
- Experience with log analysis tools
- Familiarity with SIEM concepts
- Familiarity with Firewall concepts
Ready to investigate?
More Operations
View allThe Template That Read the Disk
The file-transfer portal that Tideglow Logistics' partners upload to spent a morning returning host files it was never meant to publish, and finished it running an administrator session nobody had logged into. The root cause is CVE-2024-4040 in CrushFTP 10.6.0. Walk the access logs and firewall traffic step by step to trace how a client holding no credentials turned a request parameter into a read of the host, and that read into a takeover.
OneNote Attachment to RAT: A Guided First Investigation
A logistics contracts employee at Glacierline Freight opens an attachment that arrived in her inbox and clicks a button inside it. Minutes later her workstation is running something that appears on no software inventory and is talking to a host that no business process uses. Walk the email gateway records, the file artifacts and the endpoint process tree one step at a time, and work out for yourself which message carried the delivery, what landed on disk, and what ran.
Hijacked Discord Invite to ClickFix Loader: Tracing the Lure
A finance analyst at Halcyon Wealth Partners followed a recycled Discord invite that quietly redirected the browser to a fake verification page. They did what the page asked, and inside the hour the workstation was running a remote-access trojan alongside an info-stealer that shipped browser data straight out of the building. Walk the proxy, endpoint and firewall evidence step by step to trace the lure, the loader, the C2 beacon and the data theft.