Three Gangs, One Affiliate: A Pre-Ransomware Intrusion
A five-day, hands-on-keyboard intrusion run by a single affiliate whose tooling overlaps with three ransomware operations, caught and evicted before any encryptor ran. The operator delivered a trojanized desktop utility, ran two parallel command channels, dumped LSASS, enumerated the domain, and exfiltrated a collection archive over FTP. Reconstruct the full pre-ransomware kill chain from SIEM, endpoint XDR, and perimeter firewall telemetry, and classify the key ATT&CK techniques.
Start this operation
Investigation Tasks
Complete each task by investigating alerts and submitting your findings.
Incident brief
0Orient yourself before pivoting into the data. This is a no-answer briefing checkpoint.
Find the initial payload
35Every later event traces back to one execution on one workstation. Identify the file the user was tricked into running.
Classify the loader's evasion technique
30The remote-access module did not run as its own program. Classify how the operator executed it through a trusted binary.
Identify the second command channel
35The operator did not rely on a single controller. Identify the external IP of the second, independent backdoor channel.
Separate the pivot from the command channels
35One outbound implant was only for tunneling. Identify the external IP of the SOCKS proxy used for pivoting.
Classify the credential theft
30The operator harvested a privileged account without dropping a recognizable tool. Classify how they did it.
Recover the harvested administrator
35The memory dump handed the operator a privileged account. Identify the account they recovered and reused.
Classify the directory enumeration
30With the privileged account the operator mapped the domain. Classify the discovery of accounts and groups.
Trace the exfiltration
35Before the operator reached the domain controller, data left the network. Identify the external IP that received it.
Recover the loader indicator
35Pin down the file-level indicator for the trojanized utility so it can be hunted. Provide its SHA-256.
Classify the exfiltration technique
30The data left over a channel that was not the command-and-control path. Classify the exfiltration method.
11 tasks · 330 points total
Training Tools
Skills You'll Build
Complex multi-stage investigations. Realistic noise, ambiguous indicators, lateral movement.
Prerequisites
- Basic understanding of security alerts
- Experience with log analysis tools
- Familiarity with SIEM concepts
- Familiarity with XDR concepts
- Familiarity with Firewall concepts
Ready to investigate?
More Operations
View allStorm-0408: Malvertising Drops Lumma via GitHub
An after-hours visit to a pirated sports stream feeds a corporate workstation through a malvertising redirect chain that pulls a dropper from an abused public code-hosting service. A hidden PowerShell loader sets Run-key persistence and fetches the Lumma infostealer and a NetSupport RAT, which run through signed .NET living-off-the-land binaries to dodge application control. Lumma steals the browser credential store and exfiltrates it over HTTPS. Correlate proxy, Windows, XDR, and firewall telemetry to rebuild the chain from the ad redirect to the exfiltration endpoint and hand the team the indicators to contain it.
Storm-0501: Azure Storage Account Key Abuse and Cloud Ransom
A cloud-native ransomware operation against a hybrid Microsoft Entra ID tenant, delivered entirely through the Azure control plane with no encryptor binary. A synced non-human identity holding Global Administrator without MFA is reused to sign in, a federated-domain SAML backdoor is planted, the operator elevates to Owner over every subscription, lists the storage account keys, exfiltrates the freight archive with AzCopy, deletes snapshots, restore points and the Recovery Services vault, then re-encrypts the surviving storage with a customer-managed key in an attacker key vault and extorts over Teams. Reconstruct the chain from the Azure Activity Log, storage diagnostics, and Entra sign-in telemetry, classifying the key-theft and encryption-for-impact techniques.
HermeticWiper: Signed-Driver Destruction on the Eve of Invasion
A destructive, worm-assisted wiper operation run from inside an already-compromised Active Directory estate. An operator holding domain-administrator access pushed a binary signed to a code-signing identity to hosts over SMB, ran it as a service, and let it drop and load a legitimately signed EaseUS partition driver to reach the raw disk, overwrite the Master Boot Record, and shred the NTFS Master File Table. The crash-dump facility was disabled to slow forensics, a companion worm re-deployed the payload over SMB and WMI, and a decoy ransom note was dropped to misdirect responders. Reconstruct the destruction chain from SIEM, endpoint XDR, and firewall telemetry, and classify the key ATT&CK techniques.