APT41: ShadowPad via Signed-Binary Side-Loading
A China-nexus espionage actor exploited an internet-facing IIS research portal, side-loaded the ShadowPad backdoor through a legitimate signed binary, dumped LSASS for a domain administrator credential, and ran Cobalt Strike command and control over HTTPS. Reconstruct the intrusion from SIEM, endpoint XDR, and perimeter firewall telemetry, and classify the key ATT&CK techniques.
Start this operation
Investigation Tasks
Complete each task by investigating alerts and submitting your findings.
Incident brief
0Orient yourself before pivoting into the data. This is a no-answer briefing checkpoint.
Find the foothold
35A single host is at the center of every alert. Identify where the attacker first gained code execution.
Trace the staging chain
35From the web shell, the attacker proxied execution through a trusted Windows binary to pull the next stage. Identify the external host that served the staging script and loader.
Classify the evasion technique
30The attacker loaded its backdoor without dropping an obviously malicious executable. Identify the MITRE ATT&CK technique for the loading method used.
Recover the loader hash
35Pin down the file-level indicator for the side-loaded backdoor so it can be hunted across the fleet. Provide the SHA-256 of the malicious DLL.
Attribute the credential theft
30With SYSTEM access, the attacker went after cached credentials. Identify the MITRE ATT&CK technique for how they harvested them.
Identify the command-and-control endpoint
35The injected process maintains persistent encrypted command and control. Identify the external IP address of the primary C2.
Determine how data left the network
30Late in the day a large volume of data leaves the web server. Classify how the attacker exfiltrated it.
8 tasks · 230 points total
Training Tools
Skills You'll Build
Requires foundational alert triage skills. Multiple data sources to correlate.
Prerequisites
- Basic understanding of security alerts
- Familiarity with SIEM concepts
- Familiarity with XDR concepts
- Familiarity with Firewall concepts
Ready to investigate?
More Operations
View allCopyright Lure to Rhadamanthys Stealer
A procurement officer opened a copyright-infringement notice, followed a shortened link, and ran a signed PDF reader out of a Downloads folder. Follow the chain from a CDN-fronted delivery domain through a DLL search-order hijack and a Run-key autostart to the Rhadamanthys stealer's single command-and-control channel, where the beacon and the stolen data ride together.
PaperCut RCE to Bl00dy Ransomware
Bl00dy ransomware actors exploited an unauthenticated access-control flaw (CVE-2023-27350) on an internet-facing PaperCut MF/NG print-management server, ran code as the application service account, staged a TrueBot loader and a Cobalt Strike beacon, installed Atera and AnyDesk for hands-on remote access, moved laterally over RDP, tunnelled the file share out through a Tor helper, and deployed the Bl00dy encryptor fleet-wide. Reconstruct the intrusion from SIEM, endpoint XDR, and perimeter firewall telemetry and classify the key ATT&CK techniques.
NetSupport RAT: Phishing ZIP to Domain Compromise
A finance coordinator opened a ZIP that posed as an overdue invoice. Inside was an obfuscated JavaScript dropper that spawned PowerShell, downloaded a NetSupport Manager remote-control client, and ran it as a RAT from AppData. The operator enumerated the domain, reused a domain admin credential to RDP into the domain controller, dumped the NTDS.dit database, and tunneled it out. Trace the kill chain from the phishing email to full domain compromise.