Full Report
Stopping malware isn’t about catching one-off alerts. It’s about finding and shutting down the persistence that keeps them in your systems. Here’s how Huntress found, fought, and drop-kicked malware that others missed.
Analysis Summary
# Incident Report: Multi-Vector Persistence & Lateral Movement Campaigns
## Executive Summary
This report summarizes four distinct security incidents identified by Huntress involving local government, healthcare, medical research, and manufacturing sectors. The attacks ranged from long-term "sleeper" malware residing in systems since 2018 to active brute-force RDP breaches and SEO poisoning. In all cases, the primary objective of the attackers was establishing long-term persistence to evade standard antivirus detection.
## Incident Details
- **Discovery Date:** Multiple (January 3, 2025, and various recent dates)
- **Incident Date:** Range from 2018 to 2025
- **Affected Organization:** Multiple (Disclosed as a County Government, Healthcare Center, Medical Research Company, and a Manufacturer)
- **Sector:** Government / Healthcare / Manufacturing
- **Geography:** Not specifically disclosed (North America implied)
## Timeline of Events
### Initial Access
- **Date/Time:** Variable (Incident 2 began in 2018; others more recent)
- **Vector:** Email phishing, SEO poisoning (Gootloader), and Brute-force RDP.
- **Details:** A government employee was tricked into installing remote access tools; a manufacturer employee downloaded Gootloader via a malicious search result.
### Lateral Movement
- Attackers utilized **PSExec** to move between systems.
- In the medical research incident, attackers modified Windows Firewall rules to allow further RDP traffic throughout the network.
- Domain enumeration was performed to identify high-value targets.
### Data Exfiltration/Impact
- **Impact:** Potential for total system takeover. In the healthcare incident, malware remained active for 7 years. In the manufacturing incident, a rogue admin account ("Administralol") was created to maintain control.
### Detection & Response
- **Discovery:** Huntress Managed EDR deployment and Managed Microsoft Defender alerts.
- **Response actions:** Network isolation, automated elimination of malicious binaries, and manual eviction by Tactical Response teams.
## Attack Methodology
- **Initial Access:** Phishing, RDP Brute Force, SEO Poisoning.
- **Persistence:** .LNK files in Startup folders, Scheduled Tasks (JavaScript-based), rogue Windows Services, and renamed Mesh Agents.
- **Privilege Escalation:** Creation of unauthorized Administrator accounts (e.g., "Administralol").
- **Defense Evasion:** Renaming legitimate agents (Mesh Agent), disabling Windows credential protection, and using obfuscated x64.exe beacons.
- **Discovery:** Anomalous domain enumeration.
- **Lateral Movement:** PSExec and RDP.
- **Impact:** Long-term unauthorized access and potential for ransomware deployment.
## Impact Assessment
- **Financial:** High potential cost due to years of undetected access in healthcare systems.
- **Data Breach:** High risk of PII/PHI exposure in healthcare and research sectors.
- **Operational:** Required network isolation and remediation of multiple endpoints.
- **Reputational:** Risk to public trust in local government and medical research integrity.
## Indicators of Compromise
- **File indicators:**
- `x64.exe` (Cobalt Strike Beacon)
- Malicious `.LNK` files in `%AppData%\Microsoft\Windows\Start Menu\Programs\Startup`
- **Behavioral indicators:**
- Creation of accounts with suspicious names (e.g., "Administralol")
- Unauthorized modifications to Windows Firewall
- Unexpected PSExec execution
- Renamed Remote Monitoring and Management (RMM) tools (Mesh Agent)
## Response Actions
- **Containment measures:** Immediate host isolation via EDR.
- **Eradication steps:** Removal of rogue registry run keys, deletion of malicious scheduled tasks, and termination of unauthorized Windows services.
- **Recovery actions:** Deployment of Managed EDR to hidden "sleeper" cells and restoration of standard firewall configurations.
## Lessons Learned
- **Persistence is the primary goal:** Legacy AV often misses the "hooks" (registry keys/startup folders) that allow malware to survive reboots.
- **RDP exposure is a critical failure:** Exposed Gateways without MFA remain the primary target for brute force.
- **User Education Gap:** SEO poisoning (Gootloader) continues to be effective because users trust search engine results for work-related downloads.
## Recommendations
1. **Enforce MFA:** Ensure all Remote Desktop Gateways and administrative accounts require multi-factor authentication.
2. **Audit Persistence Points:** Regularly scan Windows Startup folders, Scheduled Tasks, and Services for non-standard entries.
3. **Endpoint Hardening:** Disable PSExec where not operationally required and implement "Least Privilege" for standard users to prevent rogue account creation.
4. **Security Awareness Training:** Train employees to recognize SEO poisoning and the risks of downloading software from non-official sources.