Salt Typhoon: Telecom Carrier Espionage
An Axiom Carrier Services edge router is behaving in ways its change record cannot explain: management sessions from addresses that should never reach it, a configuration change with no ticket behind it, and egress the estate never authorised. Work a full day of router syslog and perimeter firewall traffic and reconstruct what happened to the device, in order.
Start this operation
Investigation Tasks
Complete each task by investigating alerts and submitting your findings.
Locate the initial access vector
35A carrier edge router is behaving in ways it should not: connections from unexpected external sources, unusual processes, and logs that do not match any approved change window. Establish how the attacker first touched the device.
Identify the backdoor account
30Immediately after the exploit request, a new local account appeared on the router that does not exist in the TACACS+ authentication database. Name that account.
Confirm the persistence mechanism
35Beyond the backdoor account, the attacker planted something that survives a router reload. Identify the full path of the implant written to flash storage.
Trace the primary C2 channel
35With persistence in place, the implant establishes a command-and-control connection. Determine the domain name the implant connects to for its primary C2 channel.
Classify the secondary C2 technique
30The implant used more than one route out to its operator. Identify the MITRE ATT&CK technique covering the second of them.
Identify the transport of the unauthorised core-switch flow
25One flow left the carrier core switch for an external host during the morning. Identify the protocol it used on the wire.
Pin down the exfiltration endpoint
35Late in the session the backdoor account assembled a compressed archive on the router and sent it out. Identify the external IP address that received it.
Attribute the credential access technique
35Shortly before that archive was assembled, the backdoor account ran a single command on the router. Identify the MITRE ATT&CK credential access technique that covers what its output put within reach.
8 tasks · 260 points total
Training Tools
Skills You'll Build
Complex multi-stage investigations. Realistic noise, ambiguous indicators, lateral movement.
Prerequisites
- Basic understanding of security alerts
- Experience with log analysis tools
- Familiarity with SIEM concepts
- Familiarity with Firewall concepts
Ready to investigate?
More Operations
View allUNC3886: vCenter RCE to ESXi Persistence (CVE-2023-34048)
Orbivex Aerospace runs its virtualisation estate on a vCenter Server appliance and three ESXi hypervisors, with the vCenter HTTPS management interface published to the internet. The platform team opened a ticket during the morning shift: the appliance had logged a management daemon terminating on a fatal signal and restarting, and the hypervisor integrity summary listed package and startup-file entries the change record does not account for. Work the vCenter, ESXi and firewall telemetry and establish what reached the estate, how it moved between the management plane and the hypervisors, and how far it got.
Cactus Ransomware: Qlik Sense Exploitation
An internet-facing Qlik Sense analytics server is exploited and turned into the launch point for a Cactus ransomware intrusion. Within a day the operator persists with a rogue remote-access agent, dumps domain-admin credentials from memory, pivots by RDP to the domain controller and backup servers, steals engineering data to cloud storage, and deploys ransomware. Work the Qlik web logs, the endpoint process tree and the perimeter traffic to reconstruct the intrusion end to end and tell the abuse apart from a heavy baseline of normal analytics and remote-access activity.
Night Shift at Veridian Specialty Chemicals
Veridian Specialty Chemicals runs one Windows domain from one site: an on-premises Exchange server in the DMZ, a domain controller, and a file, backup and SQL tier that carry the plant's process data. Between the small hours and the end of the following evening the estate logged work nobody rostered. A perimeter sensor fired against the mail host. Files appeared on servers where installers never run. Administrative sessions arrived from the wrong direction. A long outbound transfer left the server tier on a port nobody watches. None of it was escalated overnight. Work the SIEM event log, the XDR process telemetry and the perimeter firewall records, and establish what reached the estate, what it took with it, and what it left behind.