Trigona Ransomware: Rclone-to-MEGA Cloud Exfiltration
A fast, RDP-only, hands-on-keyboard intrusion that went from a valid Administrator logon on an exposed RDP gateway to estate-wide Trigona ransomware in under three hours. The actor dropped a batch-script and Netscan toolkit, enumerated the network and file shares, pivoted over RDP, disabled Windows Defender by hand, exfiltrated file shares to MEGA cloud storage with a renamed rclone client, then staged and ran the Trigona encryptor over SMB. Reconstruct the full kill chain from SIEM, endpoint XDR, and perimeter firewall telemetry, and classify the key ATT&CK techniques.
Start this operation
Investigation Tasks
Complete each task by investigating alerts and submitting your findings.
Incident brief
0Orient yourself before pivoting into the data. This is a no-answer briefing checkpoint.
Trace the initial access
40Everything that follows starts with one logon on the exposed gateway. Identify the external address the intruder first logged in from.
Name the compromised account
40The intruder never needed to escalate. Identify the account they logged in with and reused on every host.
Classify the discovery tooling's share check
35Before moving, the intruder mapped the network and its shares. Classify the ATT&CK technique behind the share-enumeration artifact.
Isolate the exfiltration destination
40Before encrypting, the intruder stole the data. Identify where the file shares were copied to.
Recover the encryptor indicator
35Pin down the file-level indicator for the ransomware so it can be hunted. Provide the SHA-256 of the encryptor binary.
Classify the defense-evasion step
35Right before staging the payload, the intruder blinded the endpoint. Classify what they did.
7 tasks · 225 points total
Training Tools
Skills You'll Build
Requires foundational alert triage skills. Multiple data sources to correlate.
Prerequisites
- Basic understanding of security alerts
- Familiarity with SIEM concepts
- Familiarity with Firewall concepts
- Familiarity with XDR concepts
Ready to investigate?
More Operations
View allStaged and Gone: Rclone Bulk Upload to MEGA From a File Server
A pre-ransomware bulk data-exfiltration investigation. After a perimeter foothold and hands-on command and control, the operator pivoted to a Windows file share server, recovered a domain-administrator password from a plaintext file, staged finance data into a single archive, and bulk-uploaded it to a MEGA cloud remote with a renamed rclone client over HTTPS before any encryptor ran. The organization also runs rclone legitimately on its backup server, so the challenge is separating the sanctioned job from the theft. Reconstruct the staging-then-upload chain from SIEM and perimeter firewall telemetry.
GoldDigger: Accessibility-Abusing Banker Draining APAC Accounts
A mobile-first banking-trojan intrusion on a corporate bring-your-own-device fleet. An employee searching for a government portal sideloaded a trojanized Android installer carrying the GoldDigger banker, granted it Accessibility Service, and the trojan then keylogged, painted fake bank-login overlays, intercepted SMS one-time-passcodes, and beaconed stolen data to a cluster of attacker command-and-control domains, enabling account-draining fraud. Reconstruct the kill chain from the mobile egress SIEM, the mobile threat-defense sensor, and the perimeter firewall, and classify the key ATT&CK mobile techniques.
Consent Granted: Malicious OAuth App Mailbox BEC
A consent-phishing intrusion where an adversary-in-the-middle proxy steals a finance analyst's Microsoft 365 session, then the attacker tricks her into granting a malicious multitenant OAuth application delegated mailbox permissions. The app gets its own client secret for durable access, reads her mailbox over Microsoft Graph, hides vendor replies with an inbox rule, and sends a fraudulent bank-detail-change reply into a live settlement thread. Work the Entra consent and permission-grant audit, the service-principal credential change, the Graph mailbox operations, and the email evidence to reconstruct the chain.