Storm-0408: Malvertising Drops Lumma via GitHub
An after-hours visit to a pirated sports stream feeds a corporate workstation through a malvertising redirect chain that pulls a dropper from an abused public code-hosting service. A hidden PowerShell loader sets Run-key persistence and fetches the Lumma infostealer and a NetSupport RAT, which run through signed .NET living-off-the-land binaries to dodge application control. Lumma steals the browser credential store and exfiltrates it over HTTPS. Correlate proxy, Windows, XDR, and firewall telemetry to rebuild the chain from the ad redirect to the exfiltration endpoint and hand the team the indicators to contain it.
Start this operation
Investigation Tasks
Complete each task by investigating alerts and submitting your findings.
Brief: an after-hours infection on a creative workstation
0Read the situation before you open the evidence panels. This task has no flag; it sets the scene for the investigation.
Find where the browser left the streaming page
25Establish how the infection began. Working from the web proxy access records for the affected workstation, isolate the point where benign browsing handed off to attacker-controlled infrastructure.
Locate where the first payload was hosted
25The redirect chain ended in a download. Determine the service the attacker abused to host the first-stage payload, choosing it over the attacker-owned hops that preceded it.
Trace the loader to its dropper command-and-control
30Move to the endpoint. Read the XDR process tree to follow execution from the bundled installer through its loader, and identify the external host the loader contacted to retrieve the next stage.
Identify how the infection re-arms at logon
25The loader planted persistence before it pulled the payload. Using the Windows host telemetry, determine the autostart value the attacker created so the chain survives a reboot.
Name the signed binary that ran the stealer
30The operator avoided dropping an unsigned executable onto the run path. Determine which signed, allow-listed Windows binary they used to launch the infostealer payload from the user's profile.
Determine where the stolen credentials went
30The infostealer read the browser credential store and shipped the contents out. Identify the command-and-control destination that received the exfiltrated data.
Produce the file indicator for the stealer payload
25Containment needs a definitive file hash so the payload can be blocked fleet-wide and used to hunt other infected hosts. Provide the SHA-256 of the infostealer binary.
Classify the defense-evasion technique
25The operator's choice to run payloads through signed, trusted system binaries maps to a single MITRE ATT&CK technique. Provide its identifier.
9 tasks · 215 points total
Training Tools
Skills You'll Build
Complex multi-stage investigations. Realistic noise, ambiguous indicators, lateral movement.
Prerequisites
- Basic understanding of security alerts
- Experience with log analysis tools
- Familiarity with SIEM concepts
- Familiarity with XDR concepts
- Familiarity with Firewall concepts
Ready to investigate?
More Operations
View allFake IP Scanner to BlackCat Ransomware
A multi-day, hands-on-keyboard intrusion that began with a malvertising lure for a popular network scanning utility and ended in enterprise-wide BlackCat ransomware. The trojanized installer side-loaded a malicious library to stage Sliver and Cobalt Strike, the operator dumped credentials living-off-the-land, moved laterally over SMB, exfiltrated data with a renamed Restic client to a dedicated host, then deleted shadow copies and encrypted the estate. Reconstruct the full kill chain from SIEM, endpoint XDR, and perimeter firewall telemetry, and classify the key ATT&CK techniques.
Three Gangs, One Affiliate: A Pre-Ransomware Intrusion
A five-day, hands-on-keyboard intrusion run by a single affiliate whose tooling overlaps with three ransomware operations, caught and evicted before any encryptor ran. The operator delivered a trojanized desktop utility, ran two parallel command channels, dumped LSASS, enumerated the domain, and exfiltrated a collection archive over FTP. Reconstruct the full pre-ransomware kill chain from SIEM, endpoint XDR, and perimeter firewall telemetry, and classify the key ATT&CK techniques.
Storm-0501: Azure Storage Account Key Abuse and Cloud Ransom
A cloud-native ransomware operation against a hybrid Microsoft Entra ID tenant, delivered entirely through the Azure control plane with no encryptor binary. A synced non-human identity holding Global Administrator without MFA is reused to sign in, a federated-domain SAML backdoor is planted, the operator elevates to Owner over every subscription, lists the storage account keys, exfiltrates the freight archive with AzCopy, deletes snapshots, restore points and the Recovery Services vault, then re-encrypts the surviving storage with a customer-managed key in an attacker key vault and extorts over Teams. Reconstruct the chain from the Azure Activity Log, storage diagnostics, and Entra sign-in telemetry, classifying the key-theft and encryption-for-impact techniques.