What went wrong, and what to do about it

Cortex AgentiX Agentic Assistant streamlined this investigation by allowing the team to query the data using natural language, providing deeper context and insights, and suggesting clear recommendations on what researchers should do next. Figures 16 and 17 show examples of this.

Run endpoint protection in blocking mode, keep signatures current, and make a named team answerable for every unhandled detection within a fixed time. A Cobalt Strike or Mimikatz detection is an incident by definition, even when the antivirus reports it cleaned; restarting the server is not a response. When a connected organisation reports suspicious traffic from your addresses, examine your own hosts first. Build a monitored security operations capability with authority across the whole network, take offline backups on a fixed schedule, and keep a prioritised list of clinical systems ready for recovery.

Do not route a critical patch notice through an email distribution list: tie advisories to an asset inventory that names an owner for every internet-facing application, and require a positive acknowledgement. Verify patching with authenticated scans, and treat a clean scan for a technology you know you run as a question, not an answer. Monitor certificate expiry on security tooling as closely as on public websites, and alert when an inspection device stops inspecting. Segment databases, keep credentials out of plain-text stores, and rate-limit queries so that thousands of them look abnormal.

Put MFA on every remote access route, supplier and administrator routes first, and give any exception made for cost or convenience a named owner and an expiry date. Treat a blocked intrusion as the start of an investigation: a password reset followed by an unblock is not a review. Segment the network so that one terminal server cannot reach the whole estate, and manage third-party access through privileged access management. Keep immutable offline backups, and also make sure there is somewhere clean to restore them to. Report accepted low-level risks to senior management in aggregate, a weakness the review identifies in the Library's own risk process.

Assume a completed MFA challenge can be stolen as a session cookie and design for it: short session lifetimes, device-bound sessions, and step-up authentication before production access or token generation. One engineer's routine privileges should not include minting production access tokens without a second control. Encryption at rest gives little protection when the keys sit in a process an intruder can read, so hold keys where each use is separately authorised and logged. If you store secrets with a CI provider, prefer short-lived OIDC tokens, restrict inbound IP ranges, and rehearse a full secret rotation before you need one.

After a supplier breach, rotate from an inventory and not from memory: a credential counts as unused only when logs prove it, and then it should be deleted rather than left in place. Do not give SaaS integration accounts administrative rights over the systems they plug into. Alert on changes to administrator groups, since that is the detection that fired here. Hold staging and pre-production equipment to the same enforced ACLs as production. Expect the clean-up to cost far more than the rotation you skipped.

Block personal browser profiles and password sync on managed devices through enterprise browser policy, rather than trusting staff not to sign in. Keep service account secrets in a vault, scope them narrowly, and alert on any use from an unfamiliar network. Before an incident, list every log event type your SaaS vendors emit for file access and test that your hunt queries catch each route to the same data. Treat HAR files as credentials: strip session tokens before they are uploaded and keep token lifetimes short. When two customers report the same oddity within days, assume the common factor is you.

Get the logs off the device first, before anything else on this list. The actors’ entire evasion strategy is to control what the router remembers, and it only works while the router is the only place that record lives. Forward to a central server with immutable storage and a retention period long enough to investigate with, at informational level or better, and treat a device that stops sending as an incident rather than as a monitoring gap.

Then move the management plane out of reach. CISA’s wording is to place every management service, SSH, HTTPS, SNMP, TACACS+, RADIUS, SCP and SFTP, strictly into a dedicated out-of-band management network or a management VRF. That one change removes most of what the rest of the advisory describes.

Then patch the five and fix the defaults. CVE-2024-21887, CVE-2024-3400, CVE-2023-20273, CVE-2023-20198 and CVE-2018-0171 are the priority list. Change every weak and default SNMP community string and move to SNMPv3 only. Switch to Type 8 password storage. Require public-key authentication for administrators and disable password authentication where you can. Turn off Guest Shell and Smart Install.

And audit the configuration as a detection rather than as housekeeping. An access control list carrying an address nobody recognises, an unexpected tunnel, a new SPAN or ERSPAN session, a packet capture command, a TACACS+ redirect: each is a specific thing to go and look for, and not one of them will alert on its own.

Turn the recovery controls on before you need them, because not one of them can be applied afterwards. Versioning, immutability policies and resource locks on storage, and Azure Defender for Storage for detection. Data that is already encrypted cannot be retroactively versioned.

Then close the logging gap by watching the control plane instead of the data plane. If customer-provided keys and encryption scopes do not appear in storage logs, the observable events are elsewhere: a key vault created and a key generated and then deleted in quick succession, a customer-managed key configuration pointing at a tenant that is not yours, a soft-delete retention being shortened, protection features being removed. Datadog lists each of those, and they are the detections that survive the gap.

Then take long-lived credentials out of the picture. This is an identity attack with a storage outcome, and all four methods begin from access somebody already held. Short-lived, narrowly scoped tokens is the control at the real entry point rather than at the visible one.

And rehearse the recovery. A cloud storage account is exactly as restorable as the versioning and immutability you configured in advance, and nobody wants to find out which they have during the incident.

The report carries no mitigations, so these come from CISA’s joint advisory on this ransomware family, which does.

Start with the two that decide the outcome. Offline, immutable backups covering the whole estate, proven by an actual restore rather than by a green tick. And MFA on everything reachable from outside, especially the VPN, which is where this family gets in when it is not a poisoned download.

Then make privilege creation loud. An account added to Enterprise Admins is a handful of events a year in most organisations and it should wake somebody. CISA’s list includes reviewing domain controllers and directories for new or unrecognised accounts, which is the same control read from the other end and much too late.

Then watch the built-in tools. wbadmin against NTDS.dit, vssadmin deleting shadow copies, WMI removing recovery: all administrative utilities doing administrative things, which is exactly why they are used. Alert on the behaviour and accept the false positives, because the true positive is this.

Then segment, and put a clock on administrative access. CISA recommends just-in-time access for admin-level accounts, which turns two unattended days of Enterprise Admin into a window somebody had to ask for.

And give people a software catalogue. This began with a search engine, a lookalike domain and an installer, which is the same opening as two other entries in this section.

Put a delay between publish and consume. A release cooldown is the highest-value control against this whole class, because the worm ran its course in under four hours, and a policy of not installing anything published in the last day or two would have missed all of it. Zscaler recommends it and hardly anybody does it.

Then stop installing what you did not pin. Lockfiles applied strictly, npm ci rather than npm install, and a private registry proxy in front, so that a version published an hour ago cannot arrive in a build because a caret in a manifest allowed it to.

Then treat your build runner as a credential store, because that is what it is. Scoped, short-lived tokens instead of long-lived publishing credentials, restricted outbound network access from build environments, and pinned versions for every tool the build invokes. This spread because tokens were sitting where poisoned code could read them.

Then audit pull_request_target in your GitHub Actions workflows, which earlier waves of this campaign abused to steal a privileged token, and watch repositories that hold publish permissions for orphan commits and unexpected workflow files.

And change what provenance means inside your organisation. Treat it as an answer to where this came from, never as an answer to whether it is safe. If a policy anywhere says a signed package with valid attestation may skip review, this is the campaign that should change it.

Monitor the trusted root certificate store. Additions are rare, high-signal, and almost never legitimate outside your own management tooling. This is one of the few entries in this section where a single detection would have caught the thing that mattered most.

Then treat a request to bypass a platform protection as the end of the conversation. Huntress puts it as well as it can be put: unexpected requests to run terminal commands, bypass Gatekeeper, install a manual update or enter a device password are each, on their own, enough to stop.

Then say something to staff before a conference rather than after one. This campaign targeted attendees by name and by interest, and the approach arrived through a social platform rather than corporate mail, where none of your controls apply and none of your logging reaches.

And if a machine ran it, the response is larger than what you can see. Isolate it, collect the evidence, reimage. Assume every credential on the machine is gone: revoke active sessions, reset passwords, rotate API keys and other secrets, and check cryptocurrency wallets if there are any. That is Huntress’s own list, and the wallet line is there for a reason.

The report offers none, so these come from the FBI’s June 2026 public service announcement on malicious traffic distribution systems, which describes the same mechanism.

For organisations the FBI lists four things: monitor endpoints, change default file associations so that a downloaded script does not execute on a double click, run user training and awareness, and audit and patch your web hosting administration, because a compromised site of yours is what feeds a system like this in the first place.

Then the one that matters most for a workforce, which is not on anybody’s list because it is not a security control. Publish the canonical download location for every application you support and make it easier to reach than a search. This entry and the counterfeit installer campaign elsewhere in this section are the same failure approached from two directions, one as consumer fraud and one as enterprise compromise.

Then treat a CAPTCHA gate in front of an unexpected download as a signal rather than an obstacle. It exists to make sure your sandbox never sees what your user sees, so a page that challenges automation before serving a file is telling you what it thinks of automation.

And expect your own estate to end up as somebody’s infrastructure. This operation runs on legitimate services throughout, and a hosting provider suspension is what ended a slice of it.

Configure Windows Terminal to warn when pasted text contains multiple lines. It is one setting, it is in Microsoft’s own list, and it interrupts the precise moment this technique depends on.

Then close the clipboard-to-shell path properly. AppLocker or Group Policy to restrict PowerShell and the Run dialog, an App Control policy that stops native Windows binaries launching from Run, PowerShell Constrained Language Mode, and script block logging so that when somebody does paste something you still have the text afterwards.

Then hunt the sideload. LockScreenContentServer.exe running from a path it does not belong in is a specific and cheap detection, and DLL sideloading in general deserves a rule that does not depend on knowing which legitimate binary gets used next.

Then teach the pattern rather than the campaign. Any page that asks a visitor to copy something into a terminal, a Run box or a browser console is hostile, without exception, regardless of how the page is branded. That one sentence is the defence, and it survives every rename of the technique.

And if a host ran it, treat the tunnel as network access. Microsoft’s guidance is to assume network-level access through the compromised host and rotate every credential reachable from it.

Turn on Tamper Protection everywhere, and verify it is on rather than assuming. It is the control that carried this incident, refusing Defender exclusion and registry writes from a payload that already held SYSTEM. An endpoint agent an attacker can tell to ignore a directory is an endpoint agent with an off switch.

Then alert on the tamper sequence rather than on any one part of it. A scheduled task created as SYSTEM, then shadow copies deleted through vssadmin, then a service disabled, is a short and specific chain that almost nothing legitimate produces. Microsoft names it as the alert to build, and it is cheap.

Then block the delivery. Treat look-alike download archives as malicious in web and mail flow, and correlate the referrer: FileOriginUrl and FileOriginReferrerUrl tell you an executable arrived from a search result rather than from your software catalogue, which is this entire campaign in one field.

Then use the prevalence and age rule. Blocking executables that do not meet a prevalence, age or allowlist test is the attack surface reduction rule matching this exactly, and it is one of the few that stops something nobody has seen before.

And give people a legitimate place to get software. Every counterfeit installer campaign competes with your own software distribution, and it wins whenever yours is slower or needs a ticket.

Restrict who can reach your staff. Teams external access left open is the front door here, and scoping it to the domains you actually collaborate with is a change most organisations can make this week and almost nobody notices afterwards.

Then give the helpdesk an identity people can check. An internal verification phrase, or a rule that support is only ever initiated through your own ticketing system and never through a chat message, removes the pretext instead of the payload. Both Microsoft’s list and CISA’s end in the same place, which should tell you where the leverage is.

Then restrict WinRM to authorised management workstations, and alert on WinRM launched from a user-context process. If you take one technical action from this entry, take that one. It is the step where one laptop became dozens of hosts.

Then treat a remote support session as a privileged action with a record. Device or identity checks before the session opens, MFA and a compliant device enforced through Conditional Access, and a log that says who connected to whom and when.

And if it happened, the machine is not the incident. Microsoft’s guidance is to "assume the operator obtained network-level access" and to rotate every credential reachable from the affected host. Reimaging the laptop and closing the ticket is how this comes back.

If you sell inference, your abuse detection has to work on the shape of a customer rather than the shape of a request. CISA’s first recommendation is monitoring of anomalous prompts, accounts, networks and behaviours together, and the word carrying that sentence is "together". A campaign like this looks ordinary at every individual layer and only appears when you join them.

Then make the block cost something. The most practical detail in the advisory is that blocking triggered automated failover between pathways, which means a block that is instant and unambiguous is a block that trains the client. Responses that degrade rather than refuse, and that cannot be attributed to one request, are much harder to build a failover around.

Then treat account registration as a security boundary and not a signup funnel. Fraudulent accounts were the way in, and everything downstream inherits whatever that check was worth.

And for everyone who does not sell an API, the transferable part is smaller and more useful. This is a product being used exactly as designed, at a volume and for a purpose nobody intended, by a customer who paid. Nothing in a normal security stack points at that. Work out who in your organisation would notice, and whether they have the data to.

Put the control where the money is. This is a fraud against a payment process and no mail filter is the right layer for it. Any change to vendor bank details, and any payment over a threshold you set, gets verified by a call to a number already on file, never a number that came with the request. Write it down as policy, tell accounts payable that it will never be waived for urgency, and mean it, because urgency is the entire pretext.

Then do the mail controls anyway, because they raise the cost. SPF, DKIM and DMARC published properly on your own domain break the impersonation of your own chief executive that this runs on, and Zero-hour auto purge pulls delivered copies back once a campaign is recognised. Both are on Microsoft’s list.

Then teach the artefact rather than the story. Show the finance team a fabricated quoted thread in your own mail client, with the alignment wrong, and let them see it once. A person who has seen the tell recognises the next campaign. A person who has only been warned about invoice fraud recognises only the version they were warned about.

And score sender domain age at the gateway. It is a cheap rule with a high yield, and this campaign’s infrastructure was three days old when it started sending.

Disable Smart Install on every device, today. It is a provisioning feature that almost nobody uses past the first day, and it listens on TCP 4786 whether you use it or not.

Then deal with SNMP. Move to SNMPv3 with authPriv, turn off v1 and v2, change the community strings that are still the shipped defaults, and grant read-only where read is all that is needed. If you cannot change version yet, take CISA’s interim position: allowlist the object identifiers that can be read, and write an intrusion detection rule for inbound Set-Requests against the sensitive ones.

Then close the management plane. Access control lists on the management protocols, and block the ports at the edge: UDP 69 for TFTP, TCP 4786 for Smart Install, UDP 161 and 162 for SNMP, TCP and UDP 10161 and 10162 for SNMPv3. A router that answers management protocols from the internet is a router somebody else is also administering.

Then look for what they leave behind. CISA’s detection guidance is to monitor for local account logins on network devices and for credentials that do not match your naming convention. That is a cheap, specific check, and in most organisations nobody has ever run it against the network gear.

And put the end-of-life list in front of whoever signs for capital spend, with this advisory attached to it. On those devices the recommendation is replacement, and pretending otherwise just moves the risk onto next year.

Treat the captive portal as hostile, because in this campaign it was. The practical control is that the corporate tunnel comes up before anything else and stays up, in full rather than with a local proxy exception, and that DNS goes to your resolver instead of the network’s. Zscaler’s version of this is a list of their own settings, but the principle underneath it ports to whatever you run.

Then block device code flow in Conditional Access. It is the single change here that closes the identity half of the attack. Almost nobody uses the flow for real work, the people who do can be scoped into an exception, and without it the genuine Microsoft prompt that makes this work never appears.

Then alert on new device registrations in Entra ID, because that is what a successful device code phish looks like from your side of the glass. It is one of the few signals in this chain that reaches your tenant at all, given that everything before it happened on somebody else’s network.

And have the travel conversation, which is cheaper than any of the above. A phone hotspot removes the entire attack. Say so before the conference rather than after it.

Take them off the internet. Everything else on CISA’s list is secondary to that and the advisory puts it first: put the controller behind a secure gateway, and if it reaches the world through a cellular modem, secure that modem with strong authentication and turn its logging on. That modem is a second internet connection, and it is usually missing from the asset inventory because nobody in IT provisioned it.

Then the two physical steps, which cost nothing and are the ones most often skipped. Put the mode switch in run position. Enable programming protection in the configuration software. A controller sitting in remote-programmable mode with no programming password is a controller that anybody who can reach it can rewrite, and no firewall rule compensates for that.

Then verify the logic rather than the device. If you were exposed, the question is not whether the PLC is patched but whether its project file still says what your engineers wrote. Use the vendor’s integrity tooling to compare against a known-good copy, and check specifically that the shutdown and alarm logic is present and enabled. The manipulated display is precisely why you cannot answer this from the control room.

Then the rest of the list: change the default passwords, add multi-factor authentication where the platform supports it, block Telnet, FTP, RDP, VNC and any web service you are not using, and keep offline backups of the project files that somebody has actually restored from at least once.

Phishing-resistant MFA is the answer and the campaign knows it, which is why the lure is a passkey enrolment. Enforce FIDO2 through Conditional Access, and while you are in there block device code flow and authentication transfer flow. Most organisations use neither for anything, and the few people who do can be scoped into a named exception. Those two changes close the path that makes the rest of this optional.

Then give the helpdesk a script. An internal authentication phrase, or a callback to the number in the directory rather than the one that rang you, costs nothing and is the control the attacker cannot buy around. Microsoft’s own list ends on verifying helpdesk identity before any credential or MFA reset, which is a process problem rather than a product one.

Then treat authentication method registration as a security event in its own right. A new authenticator app or phone number added to an account should generate an alert somebody reads, and registration of security information should sit behind strict Conditional Access. This is the step that turns a one-hour session into standing access, and it is the cheapest place to catch it.

And write the response down before you need it. Revoke sessions and refresh tokens, reset the credential, and remove the authentication methods the operator added, in that order. Turn on Microsoft Graph activity logs and mailbox auditing now, because the reading is quiet by design and without those logs there is nothing to reconstruct it from.

Check the version first, because that is the whole of the immediate question. If you are on a vulnerable Zimbra build and cannot patch today, CISA’s interim advice is to move people off the Classic webmail client entirely and onto another mail client until you can. An advisory recommending that users stop using a product’s own interface is telling you how it rates the exposure.

Then assume the reads happened. What was taken is ninety days of mail and the address list, so this is not only a credential rotation. Revoke every Application Passcode and 2FA scratch key, force password changes, and go looking for the evidence: the SOAP request patterns CISA lists in mailbox.log, and localStorage items named zd_comp_YYYY-MM-DD.

Then fix the thing that made the credential theft free. Autofill into an invisible form is browser behaviour, not a Zimbra bug, and the next webmail scripting flaw will use it the same way. Moving authentication to a third-party service that supports passkeys takes the password out of the browser’s hands entirely, which is CISA’s own recommendation here and the only one on the list that survives the next occurrence.

And keep the network data. Every detection CISA offers is netflow or DNS: frequent queries with randomised subdomains, spikes to recently registered domains, outbound volume to virtual private servers. None of it is answerable without packet capture or NetFlow retained long enough to look backwards, which is a decision you make before the advisory rather than after it.

Go and check which of your automated response actions are actually armed, on which machines. Not whether the product is licensed, and not whether the feature is on in the console, but whether it will act tonight on the hosts that decide the outcome: domain controllers, file servers, the VPN concentrator, the jump boxes. A response capability configured across most of an estate is one the attacker routes around, and the part that was missed is never random. Ask for the coverage list rather than the coverage number.

Then write down who may cut a session, and when, and without whose permission. This intrusion ran for three days through alerts that a person could have acted on, and the reason teams default to watching is almost never that they did not believe the alert. It is that nobody has told them in writing that they are allowed to pull a host off the network at two in the morning and be wrong about it.

Then take the exfiltration signal seriously on its own. Rare-destination cloud storage is the most useful single rule here: more than 30 connections to a Wasabi endpoint from a host that had never spoken to it, carrying gigabytes, in an environment where nothing legitimate uses that provider. If your egress alerting is tuned on total volume rather than on destination rarity, that traffic looks like a backup job.

And rotate the VPN credentials and check what else they open. This started with valid credentials on remote access, which is the same first step as most of what lands in this section.

Start with what not to chase. The file hashes and the per-delivery 8-hex identifiers change every build, so they're low-value on their own. Anchor on the behaviours, which don't change: curl -k with a Base64-decoded URL piped into zsh, the loader's execution and its ~/.zshrc persistence.

Catch the credential spray before it becomes a foothold: Alert on bursts of failed VPN logins against multiple usernames from one source. Correlate those failures with a successful login from the same IP or ASN within a short window.

Tune what you already own before you buy anything else. Two organisations, the same tradecraft, opposite outcomes, and the variable was a baseline rather than a product. Go and count what share of last week's alerts your analysts closed without investigating. That share is your actual detection coverage, and it is usually nothing like the coverage on the licence.

Then give your defenders the authority to act on what they find. Organization A's analysts were not short of alerts, they were short of permission, and "wait and see" is what a team defaults to when nobody has written down who may pull a host off the network at two in the morning. Write that down.

Then fix the two cloud gaps both of them shared, because those are the ones that survive eviction. Apply Conditional Access to workload identities and not only to people, and write the token revocation procedure before you need it: refresh tokens outlive the containment you are proud of, and nobody improvises that step mid-incident. While you are there, go looking for long-lived static IAM keys set never to expire. Organization A's were sitting in configuration files in users' home directories, which is where yours will be.

Scan your own perimeter from outside and find the RDP you do not know about, because there almost always is some: a vendor's jump box, a forgotten test server, an acquisition nobody folded in. Put remote access behind a VPN or a gateway with phishing-resistant MFA and take 3389 off the internet entirely. Then fix the backups properly: offline or immutable, and restorable by an account that domain compromise cannot reach. Test a restore this quarter. An untested backup is a belief, and this is the family that finds out.

Keep code-signing keys in an HSM and sign through a service that logs every request, so that a compromised build host can ask for a signature and still never possess the key. Treat that as a hard requirement rather than a maturity goal: it is the specific control that turns this incident from a supply-chain catastrophe into an expensive inconvenience. On the consuming side, inventory your remote access tools and know which vendor can reach your estate, because their incident is your incident, and the version pinning that protects you here has to be decided before their disclosure lands, not after.

Treat identity verification at the help desk as a security control with a written procedure, not as a customer service judgement call. High-privilege resets need a second channel: a callback to the number in the HR record, a manager approval, or an in-person check. Then go and test it, by having someone your desk does not know attempt exactly this call. Most organisations that believe they are covered here have never tried it, and the ones that have usually stop believing it. The technical lesson is smaller than the procedural one: no amount of MFA helps when the help desk will re-enrol the factor for whoever asks.

Treat every corporate credential that has ever appeared in an infostealer dump as burned, and rotate on exposure rather than on schedule; ninety-day expiry does nothing about a password stolen on day two. For any SaaS tenant holding regulated or bulk data, require MFA and restrict access to known network ranges, then verify both from an unmanaged device. If you sell the platform, make MFA the default: this campaign is the argument that a permissive default eventually becomes your incident regardless of where the responsibility line is drawn.

Enumerate every internet-facing authentication surface and prove MFA on each one, from the outside, by testing it rather than by reading the policy. The gap is almost never the main SSO; it is the legacy portal, the vendor appliance, the acquisition that was never folded in. Then ask the question this case actually poses: if you were unavailable for three weeks, who else stops working? That answer belongs to the business, and it is worth more than another detection rule.

Inventory the OAuth applications and service principals that cross a tenant boundary, and treat each one as a production identity regardless of which tenant it lives in. "Non-production" describes the workload, never the blast radius of the credentials inside it. Then check your password-spray detection against low-and-slow volumes specifically: a threshold tuned for a noisy spray does not fire on a patient one, and patience is free.

Treat an unreviewed alert queue as an outage of the control that feeds it. An EDR nobody watches provides evidence after the fact, not defence, and it should be reported to leadership as coverage you do not have rather than coverage you bought. Separately: write the third-party access procedure before you need it, and rehearse it. Discovering mid-incident that your own change control stands between the responders and the logs is a failure of the plan, not of the responders.