Storm-0408: Malvertising Drops Lumma via GitHub
An after-hours visit to a pirated sports stream feeds a corporate workstation through a malvertising redirect chain that pulls a dropper from an abused public code-hosting service. A hidden PowerShell loader sets Run-key persistence and fetches the Lumma infostealer and a NetSupport RAT, which run through signed .NET living-off-the-land binaries to dodge application control. Lumma steals the browser credential store and exfiltrates it over HTTPS. Correlate proxy, Windows, XDR, and firewall telemetry to rebuild the chain from the ad redirect to the exfiltration endpoint and hand the team the indicators to contain it.
Start this operation
Investigation Tasks
Complete each task by investigating alerts and submitting your findings.
Brief: an after-hours infection on a creative workstation
0Read the situation before you open the evidence panels. This task has no flag; it sets the scene for the investigation.
Find where the browser left the streaming page
25Establish how the infection began. Working from the web proxy access records for the affected workstation, isolate the point where benign browsing handed off to attacker-controlled infrastructure.
Locate where the first payload was hosted
25The redirect chain ended in a download. Determine the service the attacker abused to host the first-stage payload, choosing it over the attacker-owned hops that preceded it.
Trace the loader to its dropper command-and-control
30Move to the endpoint. Read the XDR process tree to follow execution from the bundled installer through its loader, and identify the external host the loader contacted to retrieve the next stage.
Identify how the infection re-arms at logon
25The loader planted persistence before it pulled the payload. Using the Windows host telemetry, determine the autostart value the attacker created so the chain survives a reboot.
Name the signed binary that ran the stealer
30The operator avoided dropping an unsigned executable onto the run path. Determine which signed, allow-listed Windows binary they used to launch the infostealer payload from the user's profile.
Determine where the stolen credentials went
30The infostealer read the browser credential store and shipped the contents out. Identify the command-and-control destination that received the exfiltrated data.
Produce the file indicator for the stealer payload
25Containment needs a definitive file hash so the payload can be blocked fleet-wide and used to hunt other infected hosts. Provide the SHA-256 of the infostealer binary.
Classify the defense-evasion technique
25The operator's choice to run payloads through signed, trusted system binaries maps to a single MITRE ATT&CK technique. Provide its identifier.
9 tasks · 215 points total
Training Tools
Skills You'll Build
Complex multi-stage investigations. Realistic noise, ambiguous indicators, lateral movement.
Prerequisites
- Basic understanding of security alerts
- Experience with log analysis tools
- Familiarity with SIEM concepts
- Familiarity with XDR concepts
- Familiarity with Firewall concepts
Ready to investigate?
More Operations
View allThe Template That Read the Disk
The file-transfer portal that Tideglow Logistics' partners upload to spent a morning returning host files it was never meant to publish, and finished it running an administrator session nobody had logged into. The root cause is CVE-2024-4040 in CrushFTP 10.6.0. Walk the access logs and firewall traffic step by step to trace how a client holding no credentials turned a request parameter into a read of the host, and that read into a takeover.
OneNote Attachment to RAT: A Guided First Investigation
A logistics contracts employee at Glacierline Freight opens an attachment that arrived in her inbox and clicks a button inside it. Minutes later her workstation is running something that appears on no software inventory and is talking to a host that no business process uses. Walk the email gateway records, the file artifacts and the endpoint process tree one step at a time, and work out for yourself which message carried the delivery, what landed on disk, and what ran.
Hijacked Discord Invite to ClickFix Loader: Tracing the Lure
A finance analyst at Halcyon Wealth Partners followed a recycled Discord invite that quietly redirected the browser to a fake verification page. They did what the page asked, and inside the hour the workstation was running a remote-access trojan alongside an info-stealer that shipped browser data straight out of the building. Walk the proxy, endpoint and firewall evidence step by step to trace the lure, the loader, the C2 beacon and the data theft.