Vidar: Fake Notepad++ Malvertising to Data Theft
A developer searched for a popular code editor, clicked a paid search ad, and ran an installer that was not the real thing. Follow the chain from a typosquatted landing page through a dynamic-DNS payload host to the Vidar stealer's dead-drop C2 resolution, then pin down the single hosting address that carried both the stolen data and the malware's orders.
Start this operation
Investigation Tasks
Complete each task by investigating alerts and submitting your findings.
Open the case
0An endpoint risk alert fired on a developer workstation at Helionova Interactive this morning: a process spawned from a freshly downloaded installer started reading browser credential stores and reaching out to the internet. The user thought they were installing a common code editor. Get oriented before you pivot: read the alert context, then work the proxy, endpoint, and perimeter data in order. The questions that follow walk the chain from how the file arrived to where the stolen data went.
Recover the landing page
20The download did not start at the software vendor's real site. It started at a page the user reached through a search advertisement, a lookalike of the editor's download portal. Recover the domain of that landing page.
Find the payload host
20The landing page did not serve the file itself. It redirected the browser to a second host that handed over the installer. That host is not a software vendor's content network. Recover the domain that served the download.
Fingerprint the installer
20The file the user ran looked like an ordinary installer and was padded to roughly the size of the real one. To track it across the fleet and on intelligence sources, you need a content fingerprint, not just a filename. Recover the SHA-256 of the downloaded installer.
Classify the initial access
15For the report, classify how the attacker first got code in front of the user. The compromise did not start with an email or an exploit of a service: it started with a paid search advertisement that routed the user to attacker-controlled content. Map that initial-access method to its MITRE ATT&CK technique.
Cut off command-and-control
15After it ran, the stealer did not carry its command-and-control address inside the binary. It looked the address up from a configuration string parked on a couple of legitimate public profile pages, then connected out to take orders, pull modules, and ship the stolen data. Identify the external address you would block to sever that channel.
6 tasks · 90 points total
Training Tools
Skills You'll Build
Requires foundational alert triage skills. Multiple data sources to correlate.
Prerequisites
- Basic understanding of security alerts
- Familiarity with SIEM concepts
- Familiarity with XDR concepts
- Familiarity with Firewall concepts
Ready to investigate?
More Operations
View allIcedID Botnet to Dagon Locker Ransomware
A banking-trojan infection that smouldered for twenty-nine days before erupting into domain-wide Dagon Locker ransomware. A fake document portal served a JScript dropper that installed IcedID; weeks later the operator handed off to a Cobalt Strike beacon over a separate channel, pushed it across the estate through a Group Policy scheduled task, ran AdFind discovery, dumped domain credentials by replicating the directory (DCSync), moved over SMB administrative shares, exfiltrated to AWS S3 with Rclone, and deployed the encryptor while deleting shadow copies. Reconstruct the full kill chain from SIEM, endpoint XDR, and perimeter firewall telemetry, and classify the key ATT&CK techniques.
IDAT Loader: Fake Chrome Update to Stealer
A fake Chrome update page convinced an estimator their browser was out of date, and one installer later their saved passwords and wallet data were on their way to an unknown host. Follow the chain from a drive-by MSI through msiexec, a signed application side-loading the IDAT Loader, process injection, and StealC and Lumma infostealers to a single command-and-control endpoint.
EvilProxy AiTM: Indeed Redirect to M365 Cookie Theft
An executive at a logistics firm clicks a job-themed phishing link that abuses a recruiting platform's open redirect to reach an EvilProxy adversary-in-the-middle page. The page reverse-proxies the real Microsoft 365 sign-in, so the victim completes MFA against the attacker, who captures and replays the post-MFA session cookie. Work the email, web-proxy, DNS, Entra sign-in, and perimeter records to reconstruct the redirect chain, the relay infrastructure, and the MFA bypass.