Full Report
An intrusion at a market research company used living-off-the-land techniques, but Huntress detected and mitigated the threat, uncovering tactics like service creation and registry manipulation. Learn more and get detection guidance and mitigation strategies.
Analysis Summary
# Incident Report: Targeted Espionage Intrusion at Market Research Firm
## Executive Summary
In early 2025, a targeted intrusion suspected to be conducted by state-aligned espionage actors hit a critical market research company serving Fortune 50 clients and governments. The attack primarily utilized "living-off-the-land" (LotL) techniques, including service manipulation and registry changes to facilitate credential dumping. Huntress SOC intervened by isolating a compromised server and identifying a persistent backdoor on an executive's workstation, successfully mitigating the threat.
## Incident Details
- **Discovery Date:** Early 2025
- **Incident Date:** Early 2025
- **Affected Organization:** Not disclosed (described as a critical market research company)
- **Sector:** Market Research / Professional Services
- **Geography:** Global (Targeted US-based assets and Fortune 50/Government partners)
## Timeline of Events
### Initial Access
- **Date/Time:** Early 2025
- **Vector:** Not explicitly confirmed (Attacker logged in from an anomalous hostname).
- **Details:** The threat actor gained access to a server and immediately began enumeration using LotL commands (with frequent typos).
### Lateral Movement
- **Mechanism:** The attacker utilized WMIExec and custom scripts (`1.bat`) to move between systems and interact with the environment.
- **Executive Target:** Within one day of server activity, a persistent service was established on a high-value executive's workstation.
### Data Exfiltration/Impact
- **Status:** Potential espionage. While specific data exfiltration was not detailed, the attacker successfully modified registry keys to enable plaintext credential storage and restricted admin mode for password harvesting.
### Detection & Response
- **Detection:** Huntress SOC flagged anomalous hostname logins and suspicious enumeration commands.
- **Response:** The affected server was isolated within minutes of initial execution. Following the server incident, an executive workstation was onboarded for deep forensic analysis, leading to the discovery of a Golang-based loader.
## Attack Methodology
- **Initial Access:** Anomalous remote login.
- **Persistence:** Created a service titled `WebrootCheck` (masquerading as security software) to run `1.bat`; modified a service on the workstation to run `service.exe`.
- **Privilege Escalation:** Enabled **Restricted Admin Mode** via registry manipulation (`DisableRestrictedAdmin = 0`).
- **Defense Evasion:** Used LotL techniques (cmd.exe, WMI); used an expired Webroot signature for a malicious Golang binary to masquerade as legitimate software.
- **Credential Access:** Modified `WDigest` registry settings (`UseLogonCredential = 1`) to force the storage of credentials in plaintext in memory.
- **Discovery:** Performed enumeration of DNS Zone records, mail exchange (MX) records, and recently logged-on users.
- **Lateral Movement:** Used `WMIExec` patterns (redirecting output to `ADMIN$\______.______`).
- **Impact:** Strategic espionage and credential harvesting.
## Impact Assessment
- **Financial:** Unknown; potential loss of competitive advantage in the market research sector.
- **Data Breach:** High risk of credential compromise for executive-level accounts.
- **Operational:** Minimal disruption due to rapid isolation of the primary server.
- **Reputational:** Potential impact if Fortune 50/Government client data was targeted.
## Indicators of Compromise
- **Network Indicators:**
- Connection to `Kaopu Cloud HK Limited` infrastructure (AS138915).
- Remote Access Tool: **Mesh Agent**.
- **File Indicators:**
- `c:\temp\1.bat`
- `C:\Users\Default\AppData\Local\Temp\service.exe` (Golang loader)
- `web.exe` (Mesh Agent executable)
- **Behavioral Indicators:**
- `REG ADD "HKLM\System\CurrentControlSet\Control\Lsa" /v DisableRestrictedAdmin /t REG_DWORD /d 00000000 /f`
- `reg add HKLM\SYSTEM\CurrentControlSet\Control\SecurityProviders\WDigest /v UseLogonCredential /t REG_DWORD /d 1 /f`
- Creation of services masquerading as "Webroot".
## Response Actions
- **Containment:** Rapid isolation of the first compromised server via Huntress EDR.
- **Eradication:** Removal of malicious services (`WebrootCheck`) and deletion of the temporary Golang/Mesh Agent binaries.
- **Recovery:** Onboarding of high-risk executive assets for retrospective hunting and monitoring.
## Lessons Learned
- **LotL Effectiveness:** Traditional AV failed to stop the attack because the actor used native Windows tools and registry edits.
- **Executive Targeting:** Actors prioritized an executive's workstation shortly after gaining a foothold, emphasizing the need for higher-tier monitoring for VIP users.
- **Masquerading:** Attackers successfully used expired digital signatures and service names mimicking installed security products (Webroot) to blend in.
## Recommendations
1. **Registry Monitoring:** Implement alerts for changes to `WDigest` and `Lsa` (Restricted Admin) registry keys.
2. **Credential Guard:** Enable Windows Defender Credential Guard to prevent WDigest plaintext attacks.
3. **Attack Surface Reduction:** Restrict the use of WMI and SMB between workstations to limit lateral movement.
4. **Service Monitoring:** Audit the creation of new services, particularly those executing scripts from `\temp` or `\appdata` directories.