Mounted and Loaded: ISO Container Delivery of the Bumblebee Loader
An ISO image attachment hides a visible shortcut beside a hidden DLL. The user mounts the container and runs the shortcut, which executes the Bumblebee loader via rundll32 against a DLL export. Bumblebee injects into a signed Windows Mail binary through WMI, beacons HTTPS to a C2 cluster, then layers a Meterpreter stager and a Cobalt Strike beacon. The operator runs AdFind discovery, dumps LSASS with ProcDump, creates a rogue local admin, installs AnyDesk for fallback access, and moves laterally with a harvested domain administrator before the intrusion is contained pre-encryption. Reconstruct the kill chain from SIEM, endpoint XDR, and perimeter firewall telemetry, and classify the key ATT&CK techniques.
Start this operation
Investigation Tasks
Complete each task by investigating alerts and submitting your findings.
Incident brief
0Orient yourself before pivoting into the data. This is a no-answer briefing checkpoint.
Identify how attacker code first executed
35Every later event traces back to one execution on one workstation. Identify how the loader was launched from the container the user opened.
Recover the hidden loader's hash
35Pin down the file-level indicator for the loader so it can be hunted. Provide the SHA-256 of the hidden library inside the container.
Classify the masquerading step
30The loader did not beacon under its own name. Identify the MITRE ATT&CK technique for how it hid the malicious thread behind a trusted process.
Find the beacon's command-and-control domain
30The operator layered several command channels. Identify the domain the Cobalt Strike beacon resolved before connecting.
Recover the harvested administrator
35The operator dumped credential memory on a server and got a privileged account. Identify the account they recovered and reused.
Classify the fallback remote-access channel
30Beyond the implants, the operator kept a separate way back in. Classify the technique behind the tool installed on the application server.
Trace the inbound operator address
35The fallback channel was reached from outside. Identify the external IP that connected to the remote-access service.
8 tasks · 230 points total
Training Tools
Skills You'll Build
Requires foundational alert triage skills. Multiple data sources to correlate.
Prerequisites
- Basic understanding of security alerts
- Familiarity with XDR concepts
- Familiarity with SIEM concepts
- Familiarity with Firewall concepts
Ready to investigate?
More Operations
View allKey Vault Contributor Privilege Escalation: Reading All Secrets via Access Policies
A holder of the built-in Key Vault Contributor role abuses its Microsoft.KeyVault/vaults/write permission to write itself a full data-plane access policy on a production Azure Key Vault, then dumps every secret, key, and certificate it holds. Working purely from the cloud audit trail, correlate the control-plane access-policy change in the Azure Activity Log with the data-plane secret, key, and certificate reads in the Key Vault diagnostic log, identify the principal and what it stole, and classify the privilege-escalation and credential-access techniques.
GoldPickaxe: The First iOS Trojan Stealing Your Face
A mobile-first intrusion against a retail bank's managed iPhone fleet. A relationship officer is socially engineered into installing a fake government app through Apple TestFlight and trusting a rogue MDM profile, handing GoldFactory full control of the device. The GoldPickaxe.iOS trojan harvests identity documents and a facial-recognition video, intercepts SMS, and exfiltrates over three split channels: an RSA-encrypted HTTP API, a WebSocket command channel, and an RTMP face-video stream, all to enable AI face-swap fraud against the bank's facial verification. Reconstruct the chain from mobile-threat-defense, MDM, and perimeter firewall telemetry.
Trusted Tool, Hostile Hands: Atera RMM Foothold
A phishing-delivered intrusion that weaponized a legitimate remote-monitoring tool instead of custom malware. A finance analyst was lured by a grant-program email whose link pointed at a file-sharing platform; the download was an MSI that silently installed the Atera agent, registered the endpoint to an attacker-controlled tenant, persisted as a Windows service, and beaconed to Atera's cloud over HTTPS. From the vendor console the operator ran PowerShell discovery and staged a follow-on implant, all over trusted infrastructure. Reconstruct the chain from email, SIEM, and endpoint XDR telemetry and classify the key ATT&CK techniques.